The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers…

A critical authentication bypass vulnerability exists in the TrueBooker WordPress plugin before version 1.2.4. The plugin fails to validate account ownership during the password reset process through its front-end account handler. This flaw allows unauthenticated attackers to set an arbitrary password on any user account, including administrator accounts. Successful exploitation enables full site takeover without any prior authentication. The vulnerability is tracked as CVE-2026-14545 and has been patched in version 1.2.4 of the plugin.