The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.

The TrueBooker Appointment Booking and Scheduler System plugin for WordPress contains a critical authorization bypass vulnerability affecting all versions up to and including 1.2.3. The flaw stems from the plugin failing to properly verify user authorization before performing sensitive actions. Unauthenticated attackers can exploit this to modify the email address of any user account, including administrator accounts. Once the email is changed, attackers can trigger a password reset to fully compromise the account. This effectively allows complete account takeover without any prior authentication. The vulnerability has been patched in version 1.2.4. The fix is visible in the changeset for the function_ajax.php file. The issue is tracked under CVE-2026-14349 and documented by both NVD and Wordfence.