CVE-2026-14364

Executive Summary

CVE-2026-14364 is a critical vulnerability in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, affecting all versions up to and including 1.2.3. The flaw resides in the plugin's password reset mechanism, which fails to properly validate a user's identity before permitting a password change. This allows unauthenticated, remote attackers to reset the password of any user account — including administrator accounts — and subsequently take full control of the WordPress instance. With a CVSS score of 9.8 (Critical), this vulnerability requires no authentication and no user interaction, making it a high-priority target for opportunistic scanning and automated exploitation.

Technical Analysis

The vulnerability is rooted in the plugin's handling of the password reset process, categorized under CWE-640 (Weak Password Recovery Mechanism for Forgotten Password). The NVD description confirms that the plugin "does not properly validate a user's identity before resetting their password." The CNA title references the parameter 'tbab-userid' as the mechanism through which the attacker specifies the target account.

Under normal WordPress password reset flows, the application issues a one-time token to the account owner (via email) and requires that token to be submitted alongside the user identifier. The TrueBooker plugin, however, appears to skip this step. Instead, it accepts a direct request that includes a user identifier ('tbab-userid') and a new password, processing the reset without verifying that the requester has authorization to change that account's credentials.

The attack surface is entirely network-based. An attacker only needs to send an HTTP request to the WordPress site running the vulnerable plugin. The request must reach the AJAX endpoint or form handler that the plugin registers for its password reset functionality. Because the plugin fails to implement a proof-of-possession check (e.g., a secret token sent to the victim's email), any unauthenticated user can perform the reset operation against any valid user ID.

The plugin's user lookup mechanism accepts the 'tbab-userid' parameter directly. By enumerating WordPress user IDs (which are sequential integers), an attacker can systematically target the admin account (typically user ID 1) or any other registered user. The severity is increased by the fact that the flaw does not require any special HTTP method or crafted headers, making it trivially reproducible with standard web requests.

From a code perspective, the missing authorization check implies that the password reset function either omits the nonce/token validation entirely or uses a static/weak check that can be bypassed. The NVD description does not specify a particular WordPress hook or function name, but the vulnerability pattern strongly matches an improperly implemented AJAX action in the plugin's backend that processes a POST request containing 'tbab-userid' and 'tbab-newpass' (or similar fields) and directly invokes the WordPress core wp_set_password() function.

Exploitation Scenarios

Scenario 1: Direct Administrator Takeover via ID Enumeration

1. Reconnaissance: The attacker identifies a WordPress site running TrueBooker through directory brute-forcing (/wp-content/plugins/truebooker/) or by fingerprinting the plugin's assets (style sheets, scripts). The plugin version is confirmed by reading the readme.txt file if accessible or via version tags in script URLs.

2. User ID Discovery: The attacker sends a malformed request to /?author=1 or performs a standard WordPress user enumeration attack to confirm the admin user ID (usually 1). Alternatively, they can probe the JSON REST API endpoint /?rest_route=/wp/v2/users if user enumeration is not disabled.

3. Weaponization: The attacker crafts a POST request to the plugin's password reset handler. The request contains the parameters tbab-userid=1 and the new desired password, e.g., tbab-password=Pwn3d!2026. The HTTP request is sent to the WordPress installation root or the admin-ajax.php URL, depending on the plugin's implementation:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: victim-site.com
   Content-Type: application/x-www-form-urlencoded
   
   action=tbab_reset_pass&tbab-userid=1&new_password=Pwn3d!2026
   

   Note: The action name is illustrative; the exact parameter for the new password is not specified in the CVE description.

4. Execution: The plugin processes the request without validating any token, nonce, or email confirmation. It calls WordPress's password update function directly, overwriting the admin's password.

5. Post-Exploitation: The attacker logs into /wp-login.php using the new password. Once authenticated as administrator, they install a webshell or backdoor plugin, exfiltrate the database, deface the site, or pivot to the hosting server.

Scenario 2: Mass Account Compromise via Scripted Enumeration

1. The attacker scripts a loop in Python or Bash that iterates over user IDs 1 through 10,000.
2. For each ID, the script sends the reset request with a random password.
3. The attacker then checks which IDs are valid by attempting login; invalid IDs fail the password reset silently (if the plugin doesn't return an error), while valid IDs become compromised.
4. The attacker sorts through the successfully compromised accounts, targeting those with administrative roles by checking user metadata or by attempting to access the wp-admin dashboard.

Exploitation Constraints: The attack is fully remote and unauthenticated. The only precondition is that the target site has the TrueBooker plugin installed and the vulnerable password reset functionality is accessible. There is no known public exploit code for this CVE, but the vulnerability class (missing authorization in password reset) is well-understood and can be reproduced with minimal effort by a competent penetration tester.

Impact Assessment

Business Impact: This vulnerability results in complete compromise of the WordPress installation. An attacker gaining administrative access can:

• Inject malicious JavaScript into pages, affecting all site visitors (client-side attacks, SEO poisoning).
• Modify site content for defacement or phishing.
• Install malicious plugins or themes that persist even after the initial issue is patched.
• Access the underlying database, potentially exposing customer PII, payment data (if the site uses stored transaction records), and business-critical information.
• Use the compromised server as a pivot point for further network intrusion if the WordPress instance is hosted on a shared or virtualized server.

CVSS Subscore Analysis: The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates a network-exploitable vulnerability with low attack complexity, no privileges required, and no user interaction. The scope is unchanged (S:U), meaning a successful exploit affects only resources managed by the same authority, but the impact on confidentiality, integrity, and availability is rated High. The 9.8 score reflects the triviality of exploitation combined with full system-level impact.

Blast Radius: Any WordPress site running TrueBooker ≤ 1.2.3 is at risk. This includes appointment-based businesses (clinics, salons, consulting firms) that rely on the plugin for booking management — these organizations often handle sensitive personal data (medical details, contact information) and are attractive targets for identity theft and ransomware campaigns.

Affected Systems: All versions from the initial release through 1.2.3. The vendor has not yet released a patched version, leaving the entire installed base vulnerable.

Detection Guidance

The following detection rules are designed to identify exploitation attempts for this vulnerability. They focus on the distinctive HTTP request patterns and user-agent behaviors associated with automated attacks.

Sigma Rule

title: TrueBooker Password Reset Abuse - Unauthenticated Attempt
status: experimental
description: Detects HTTP POST requests targeting TrueBooker password reset with tbab-userid parameter without prior session.
logsource:
  category: webserver
  product: apache
  definition: 'Requirements: access logs with POST body captured via mod_security or reverse proxy'
detection:
  selection:
    cs-method: POST
    cs-uri-query|contains:
      - 'admin-ajax.php'
      - 'tbab'
  keywords:
    - 'tbab-userid'
    - 'action=tbab_reset'
  condition: selection and keywords
falsepositives:
  - Legitimate password reset from a user who lost their password
level: high

YARA Rule

rule Detect_TrueBooker_Exploit_Payloads
{
    meta:
        author = "Threat Intel Team"
        description = "Detects HTTP payloads containing TrueBooker reset parameters"
        cve = "CVE-2026-14364"
        date = "2026-01-01"
    strings:
        $s1 = "tbab-userid" ascii wide nocase
        $s2 = "tbab_reset" ascii wide nocase
        $s3 = "tbab_password" ascii wide nocase
        $s4 = "action=tbab" ascii wide nocase
        $s5 = "wp-admin/admin-ajax.php" ascii wide nocase
    condition:
        (any of ($s1, $s2, $s3, $s4)) and $s5
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT TrueBooker Password Reset Attempt CVE-2026-14364"; flow:established,to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"tbab-userid"; http_client_body; fast_pattern; content:"action="; http_client_body; within:50; reference:cve,2026-14364; sid:202614364; rev:1;)

Elastic Detection

sequence by source.ip, user.name
  [ network where event.category == "web" and event.action == "request" and
    http.request.method == "POST" and
    url.path contains "admin-ajax.php" and
    url.query contains "tbab" ] with maxspan=5m
  [ file where event.action == "read" and process.name contains "php" and file.name contains "wp-includes" ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="*admin-ajax.php*"
| eval is_tbab = if(match(form_data, "tbab-userid"), 1, 0)
| where is_tbab=1
| stats count by src_ip, uri, form_data, _time
| sort - _time
| table _time, src_ip, uri, form_data, count

Wazuh OSSEC Rule

<rule id="100236" level="12">
  <decoded>postvar</decoded>
  <field name="url">admin-ajax\.php</field>
  <match>tbab-userid</match>
  <description>TrueBooker plugin password reset manipulation attempt detected (CVE-2026-14364)</description>
  <group>pci_dss_6.5, gdpr_32, attack_exploitation,</group>
</rule>
<rule id="100237" level="15">
  <if_sid>100236</if_sid>
  <match>action=tbab_reset</match>
  <description>TrueBooker exploit: unauthorized password reset execution (CVE-2026-14364)</description>
</rule>

Mitigation & Patch Guidance

Patch Status: As of this intelligence report, no patched version of TrueBooker has been released. The vendor advisory is pending, and the current version 1.2.3 remains vulnerable. Patch confidence is rated 0/4, indicating no confirmed fix exists in any tracked source.

Immediate Mitigations (until a patch is available):

1. Disable the plugin immediately. If business continuity requires the booking functionality, deploy a competing plugin that is actively maintained. Disabling the plugin without removal is unsafe — attackers can still access exposed endpoints if the files remain.
2. Implement a Web Application Firewall (WAF) rule to block any POST request containing the string tbab-userid and an action parameter referencing reset or password functions. ModSecurity rules or Cloudflare WAF custom rules can offer temporary protection.
3. Restrict access to wp-admin and admin-ajax.php using IP allowlisting or at minimum enforce HTTP Basic Authentication on the admin area.
4. Monitor authentication logs for successful logins from unrecognized IPs on administrator accounts. Immediately revoke sessions and force password resets if suspicious activity is observed.
5. Remove all unused user accounts and ensure the admin account uses a non-standard username (avoid "admin").

Patch/Upgrade Steps:

1. Monitor the WordPress plugin repository and the vendor's official channel for version 1.2.4 or higher.
2. Before upgrading, back up the site database and files.
3. Apply the update immediately upon release, then test the booking workflow thoroughly.
4. After patching, rotate all user passwords and invalidate existing sessions (via a forced logout plugin or by clearing the wp_users session tokens).

Long-Term Hardening:

• Enforce strong password policies and two-factor authentication for all administrative roles.
• Regularly audit installed plugins; remove any that are not in active use or have not received updates within 90 days.
• Subscribe to the WordPress security mailing list and the plugin's changelog to receive immediate notification of security releases.
• Implement file integrity monitoring for the wp-content/plugins and wp-admin directories.
• Ensure the web server is configured to block direct access to plugin PHP files (legacy if not using proper AJAX endpoints).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-14364 — Official NVD record with CWE classification and CVSS vector.
2. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2026-14364 — Mitre CVE listing containing the CNA title reference to the 'tbab-userid' parameter.
3. WordPress Plugin Directory: https://wordpress.org/plugins/truebooker/ — Official plugin page; check for version history and changelog updates regarding the security fix.
4. CWE-640 Reference: https://cwe.mitre.org/data/definitions/640.html — Weak Password Recovery Mechanism for Forgotten Password, the weakness class applicable to this vulnerability.
5. FIRST.org CVSS Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — Reference for the CVSS vector scoring used in this report.

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence has been reported for CVE-2026-14364 at the time of writing. The CISA KEV catalog does not include this CVE. However, given the ease of exploitation and the critical CVSS score, it is highly probable that automated scanning tools targeting WordPress plugin vulnerabilities will incorporate this flaw into their payload sets. Organizations using TrueBooker should treat this as an active risk and prioritize immediate mitigation.