VulnSocial

CVE-2026-14545Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-28: 2Patch / Workaround · 2026-07-28: 1Technical Details · 2026-07-28: 207-28
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • ADK Cyber@ADKCyber
    Disclosure

    CVE-2026-14545 (CVSS 9.8): TrueBooker WordPress plugin before 1.2.4 allows unauthenticated password reset via account handlers. Update immediately if in use. https://nvd.nist.gov/vuln/detail/C… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/RJim9hqstQ

    Post summary

    The tweet announces a high‑severity unauthenticated password reset vulnerability in the TrueBooker WordPress plugin and urges users to update immediately. It provides basic technical details but no exploit code or active‑use evidence.

    0000044
    90 followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-14545 Unauthenticated Account Takeover in TrueBooker WordPress Plugin Before 1.2.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-14545

    Post summary

    This text announces an unauthenticated account takeover vulnerability in the TrueBooker WordPress plugin versions prior to 1.2.4, but provides no PoC, exploit code, or mitigation details.

    0000077
    4.1K followersView on X

Explore more

Back to dashboard