Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-14349: TrueBooker allows anyone to change any user’s email
CVE-2026-14349 · published 3 days ago
Summary
The TrueBooker appointment booking plugin for WordPress does not check who is making a request. As a result, even someone without a login can alter the email address of any user, including site administrators, which could lead to password resets and unauthorized access. Update the plugin to the latest version or remove it until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| themetechmount | truebooker – appointment booking and scheduler system | <= 1.2.3 |
Original advisory text
TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Severity
9.8
Critical
CVSS 3.1: 9.8 (NVD)
Exploitation
EPSS <1%
Type
CWE-862Missing Authorization
Timeline
Published16 Sep 2026
Updated19 Sep 2026
First seen16 Sep 2026
Track software like this
Free during beta