CVE-2026-14365

Executive Summary

CVE-2026-14365 is an authorization bypass vulnerability residing in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, affecting all versions up to and including 1.2.3. The flaw stems from insufficient authorization verification on sensitive actions, allowing unauthenticated remote attackers to change the password of any user account—including administrators—bypassing authentication entirely. This leads to complete account takeover and, given the plugin's implementation, likely grants full administrative control of the WordPress instance. With a CVSS score of 9.8 (Critical), this vulnerability poses an immediate and severe threat to any WordPress site running the affected plugin, requiring urgent action to mitigate risk.

Technical Analysis

The vulnerability originates from a failure in the plugin's access control mechanisms, classified under CWE-862 (Missing Authorization). The TrueBooker plugin, designed for appointment scheduling, implements various user-facing and administrative functional actions. In versions up to and including 1.2.3, at least one of these actions—specifically a password change routine—lacks the required permission checks to verify the identity and privileges of the caller.

The plugin's codebase likely registers a function to handle password modification, typically hooked into WordPress's AJAX API or a direct admin-post handler. This handler receives user input parameters (e.g., a username or user ID and a new password) and executes the change without validating that the requester is logged in, nor that they possess the appropriate capabilities (e.g., edit_users or manage_options) or a valid nonce token. Additionally, no verification is performed to ensure the requester is modifying their own account versus an arbitrary target account.

From a technical perspective, the attack surface is the web-accessible entry point—either the wp-admin/admin-post.php endpoint or an AJAX action handler. Since the implementation relies on the presence of the plugin's specific action hooks without an accompanying authentication check, an unauthenticated HTTP request can reach the vulnerable code path. The absence of any capability checks or nonce validation within the handler allows the action to execute with the plugin's full user-context privileges, which in this case appears to be unrestricted password alteration for any account.

The vulnerability is not limited by attacker prerequisites: no valid session, no prior knowledge of the target's current password, and no interaction with an authenticated user is required, fulfilling the CVSS vector's PR:N (No Privileges Required) and UI:N (No User Interaction) components. The only enabling condition is network access to the vulnerable WordPress instance, which is inherently met for any internet-facing site running the plugin.

Exploitation Scenarios

An attacker exploiting this vulnerability requires no more than network access to the target site. The attack chain is as follows:

1. Reconnaissance and Target Identification: The attacker begins by scanning for WordPress installations using the TrueBooker plugin. This can be achieved via search engines (e.g., Google dorking with inurl:/wp-content/plugins/truebooker/), plugins present in the HTML source (wp-content/plugins/truebooker/), or through WordPress plugin enumeration tools like WPScan. Alternatively, Shodan queries (as listed in METADATA) can be used to find exposed administrative panels or sites with booking-related titles that may indicate plugin usage.

2. Trigger and Weaponization: Once a target is identified, the attacker constructs a direct HTTP request to the vulnerable handler. The request is typically a crafted POST or GET request to the WordPress backend endpoint responsible for user password changes. The specific URL is likely one of two: wp-admin/admin-post.php with an action parameter, or admin-ajax.php with an action parameter. The attacker designates the target account by specifying the username or user ID (e.g., the default admin account) and supplies a new, attacker-chosen password. For instance, a GET request such as: http://target-site.com/wp-admin/admin-post.php?action=change_user_password&user_id=1&new_password=Pwned123! In instances where the handler expects a username rather than ID: http://target-site.com/wp-admin/admin-ajax.php?action=update_password&user_login=admin&pass1='Pwned123!'&pass2='Pwned123!'

3. Payload Execution and Access: The request is processed by the plugin's vulnerable function without any authentication or nonce verification. The PHP function executes wp_update_user() or a similar WordPress core function to set the new password hash for the specified account. Upon successful execution, the attacker immediately attempts to log in to the compromised account (e.g., admin) using the chosen password via wp-login.php. This grants them authenticated session with the compromised user's privileges.

4. Post-Exploitation Impact: With an administrator account compromised and accessible, the attacker gains full control over the WordPress installation. They can upload malicious plugins or themes, inject persistent backdoors into active theme files, deface the website, steal sensitive data (including client appointment details and PII stored by the booking plugin), pivot to the underlying server (potential RCE through theme/plugin file uploads), and use the compromised server for further malicious activities (spam campaigns, phishing, DDoS). The attacker can also wipe audit logs or create additional admin users to maintain persistence.

Impact Assessment

Business Impact: The vulnerability compromises the entire confidentiality, integrity, and availability (CIA) triad of the affected WordPress platform. Successful exploitation leads to complete account takeover of the highest-privileged accounts. For a business relying on the TrueBooker plugin for appointment management, the consequences include unauthorized access to customer PII (names, contact details, appointment history), potential financial data if the plugin integrates payment gateways, website defacement or ransomware leading to reputational damage, and operational disruption of booking services. The CVSS score of 9.8 (Critical) underscores this severity, which is driven by the network attack vector (AV:N), low attack complexity (AC:L), and unauthenticated compromise of all three security goals.

Affected Systems: Any WordPress website running TrueBooker – Appointment Booking and Scheduler System version 1.2.3 or earlier is vulnerable. This includes both web-facing sites and internal/administration sites accessible over a network.

Blast Radius: The vulnerability's exploitability from an unauthenticated remote position means the entire internet-exposed WordPress fleet is at risk. The blast radius extends beyond the website itself to the hosting server environment, as an admin-level compromise is a common precursor to server-side compromise. The WooCommerce or other e-commerce integrations commonly found in such setups would also be compromised, exposing customer payment details.

Detection Guidance

Sigma Rule

title: TrueBooker Plugin Password Change Authorization Bypass Attempt
id: 3b4f2e8d-9c1a-4b7e-8a3f-6d2e5a1c9b4f
status: experimental
description: Detects attempts to exploit CVE-2026-14365 (CWE-862) by identifying password modification requests to the TrueBooker plugin without an authenticated session.
logsource:
  product: wordpress
  service: web
detection:
  selection_access_control:
    cs-method: 'POST'
    c-uri|contains: 
      - '/wp-admin/admin-post.php'
      - '/admin-ajax.php'
    c-uri|contains:
      - 'truebooker'
      - 'password'
  selection_actions:
    cs-referer|endswith:
      - '/truebooker/'
  filter_authenticated:
    cs-username|exists: true
  condition: selection_access_control and selection_actions and not filter_authenticated
falsepositives:
  - Misconfigured plugins with similar action handlers
  - Legacy code paths performing admin actions unauthenticated (broader plugin issues)
level: high

YARA Rule

rule TrueBooker_CVE_2026_14365_Auth_Bypass {
    meta:
        author = "ValtersIT SOC"
        description = "Detects HTTP requests targeting TrueBooker password change without authentication"
        cve = "CVE-2026-14365"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $a1 = "action=" ascii nocase
        $a2 = "truebooker" ascii nocase
        $a3 = "pass1=" ascii nocase
        $a4 = "pass2=" ascii nocase
        $a5 = "user_id=" ascii nocase
        $a6 = "user_login=" ascii nocase
        $b1 = "wp-admin/admin-post.php" ascii nocase
        $b2 = "admin-ajax.php" ascii nocase
    condition:
        uint16(0) == 0x0d0a and
        2 of ($a*) and
        1 of ($b*) and
        filesize < 4KB
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS TrueBooker WordPress Plugin Authorization Bypass Exploit Attempt (CVE-2026-14365)"; flow:established,to_server; content:"POST"; http_method; content:"/wp-admin/admin-post.php"; http_uri; content:"action="; http_uri; content:"pass1="; http_uri; content:"pass2="; http_uri; content:"truebooker"; http_uri; metadata:cve CVE-2026-14365; reference:url,cve.mitre.org; priority:1; sid:29000101; rev:1;)

Elastic Detection

sequence by host.name with maxspan=1s
  [network where event.action == "connection_attempted" and destination.port == 80 or destination.port == 443]
  [http where http.request.method == "POST" and (
    (http.request.uri contains "/wp-admin/admin-post.php" and http.request.body.content contains "truebooker" and http.request.body.content contains "pass1=" and http.request.body.content contains "pass2=") or
    (http.request.uri contains "/admin-ajax.php" and http.request.body.content contains "truebooker" and http.request.body.content contains "pass1=" and http.request.body.content contains "pass2=") or
    (http.request.uri contains "/wp-admin/admin-post.php" and http.request.body.content contains "truebooker" and http.request.body.content contains "user_id=" and http.request.body.content contains "new_password")
  ) and not http.cookie contains "wordpress_logged_in"]

Splunk SPL Query

index=web sourcetype=access_combined
| where http_method="POST" 
  AND (uri_path IN ("/wp-admin/admin-post.php", "/admin-ajax.php"))
  AND uri_query OR form_data LIKE "%truebooker%" 
  AND (form_data LIKE "%pass1=%" AND form_data LIKE "%pass2=%" OR form_data LIKE "%new_password=%")
  AND NOT cookie LIKE "%wordpress_logged_in%"
| stats count by src_ip, uri_path, user_agent, status
| sort - count

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="310520" level="15">
    <if_sid>31100</if_sid>
    <match>truebooker|TrueBooker</match>
    <regex>action=|pass1=|pass2=|user_id=|new_password=</regex>
    <description>TrueBooker Plugin Authorization Bypass Exploit Attempt (CVE-2026-14365)</description>
    <group>attack, exploit_kits</group>
    <mitre id="T1190"/>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. The vendor has not released a fix for this vulnerability as of the date of this report.

1. Immediate Mitigations (Defense in Depth):

   • Disable the Plugin: If the TrueBooker plugin is not essential for business operations, deactivate and delete it immediately to eliminate the attack surface.
   • Web Application Firewall (WAF) Rules: Deploy virtual patching via a WAF or CDN (e.g., Cloudflare, AWS WAF, ModSecurity) to block requests matching the patterns in the Detection Guidance section. This includes blocking any unauthenticated POST requests to admin-post.php or admin-ajax.php containing TrueBooker-specific action parameters combined with password fields.
   • Network Segmentation: If the site is not public-facing, restrict network access to the WordPress server to trusted IP ranges via firewall ACLs.
   • Emergency Credential Reset: Regardless of suspected compromise, force a password reset for all WordPress administrator accounts and disable the default admin user. Schedule periodic password rotations until a patch is applied.

2. Patch/Upgrade Steps:

   • No Patch Available: Since the vulnerability is unpatched in all tracked versions (up to and including 1.2.3), upgrading is currently moot. Monitor the WordPress Plugin Directory and the vendor (TrueBooker) website daily for security updates. The moment a patched version (e.g., 1.2.4) is released, upgrade immediately.
   • Interim Code Hardening: Until a patch is available, manually add a capability check in the plugin's core. Edit the primary plugin file (e.g., truebooker.php) to add if ( !current_user_can('edit_users') ) { wp_die('Unauthorized'); } at the beginning of the password-change handler function. Note: This will be overwritten by future plugin updates and must be re-applied.

3. Long-Term Hardening:

   • Harden WordPress Core: Implement a security plugin (e.g., Wordfence, iThemes Security) to enforce login limits, disable file editing via the admin panel, and monitor for unauthorized changes.
   • Least-Privilege Principles: Audit and remove any unused administrator accounts. Ensure that all user accounts use strong, unique passwords and consider enforcing multi-factor authentication (MFA) for all admin users.
   • Threat Monitoring: Enable comprehensive logging (e.g., via a SIEM) and configure alerts for failed login attempts, large volumes of requests to admin-post.php, and any changes to user roles or permissions.
   • Vendor Accountability: Reassess the use of the TrueBooker plugin. Given the lack of a coordinated security response, evaluate alternative appointment booking plugins with a better track record of security patching. If vendor responsiveness does not improve, remove the plugin permanently.

References

1. NVD Entry for CVE-2026-14365: https://nvd.nist.gov/vuln/detail/CVE-2026-14365
2. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. WordPress Plugin Directory – TrueBooker: https://wordpress.org/plugins/truebooker-appointment-booking-and-scheduler-system/
4. WPScan Vulnerability Database: https://wpscan.com/plugin/truebooker-appointment-booking-and-scheduler-system/
5. ATT&CK Technique T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/

Known Threat Actor Campaigns: As of this report's date, there are no publicly documented threat actor campaigns or exploit-in-the-wild evidence specifically attributed to CVE-2026-14365. However, given the high CVSS score and the historical pattern of WordPress plugin vulnerabilities being weaponized by botnets shortly after disclosure, proactive monitoring and mitigation are strongly advised.