TrueBooker Bug Lets Hackers Take Over WP Admins

If your WordPress site runs the TrueBooker – Appointment Booking and Scheduler System plugin at version 1.2.3 or older, update it to the latest version now, because a critical flaw (CVE-2026-14349) lets a stranger change any user's email address, including an administrator's, and then reset the password.

This post is for owners of small WordPress sites that take bookings: salons, clinics, studios, consultants, and the agencies that build their sites. You will learn what the bug is in plain English, how to check whether you are exposed, the exact steps to fix it, and how to look for signs that someone already got in.

What is the TrueBooker vulnerability?

TrueBooker is a WordPress plugin that adds appointment booking and scheduling to a site. A security flaw was published for it on 2026-09-16 under the ID CVE-2026-14349. (A CVE is a public ID number for a known security flaw, so everyone talks about the same bug.)

According to the National Vulnerability Database (NVD) entry, the plugin does not properly check whether the person making a request is allowed to do what they are asking. This affects all versions up to and including 1.2.3.

Because of that missing check, someone who is not logged in can change the email address on any user account. That includes administrator accounts.

How does this lead to a WordPress admin takeover?

The flaw itself only changes an email address. The damage comes from what WordPress lets you do with an email address. Here is the chain the NVD description points to:

1. The attacker sends a request to the vulnerable plugin that swaps the admin's email for one the attacker controls. No login is needed.
2. The attacker opens your normal WordPress login page and clicks 'Lost your password?' for that admin account.
3. WordPress sends the reset link to the new email, which the attacker owns.
4. The attacker sets a new password and logs in as the administrator.

An administrator can install plugins, edit code, create more admin users, and read customer data stored in WordPress. That is why this is called an account takeover. It is not a small bug.

The NVD record does not say whether attackers are actively using this flaw, and we are not claiming they are. But a bug that needs no login and no tricks is the kind that gets tested widely once it is public, so treat it as urgent.

Why is the severity rated so high?

The NVD lists the score as 9.8 out of 10, rated Critical (CVSS 3.1). CVSS is a standard scoring system for how bad a flaw is. The vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H breaks down like this:

The weakness type is CWE-862, Missing Authorization. In everyday terms: the plugin has a door, and nobody checks who is walking through it. This falls under what OWASP calls Broken Access Control, one of the most common web security problems.

One note on the record: the NVD status shows as 'Deferred', which means NVD has not finished its own analysis yet. The score and description above are what is currently published. The weakness is also covered by Wordfence's vulnerability entry.

Who is affected?

You are affected if all of these are true:

• Your site runs WordPress.
• The TrueBooker – Appointment Booking and Scheduler System plugin is installed and active.
• Its version is 1.2.3 or lower.

If you do not use TrueBooker, this bug does not apply to you. If the plugin is installed but deactivated, it is not running, but delete it if you do not use it anyway. Old plugins sitting in the folder are a common source of trouble.

How to check your TrueBooker version

In the dashboard:

1. Log in to WordPress and go to Plugins > Installed Plugins.
2. Find TrueBooker – Appointment Booking and Scheduler System.
3. Read the version number under the plugin name.

With WP-CLI (the command line tool for WordPress, if you or your host use it):

wp plugin get truebooker-appointment-booking --fields=name,status,version

If the version is 1.2.3 or lower, you need to act.

How to fix it: update the plugin

The NVD record does not name a fixed version. The public code history for the plugin does compare version 1.2.3 against 1.2.4 in the file function_ajax.php (see the WordPress plugin changeset), which suggests the fix landed there. Do not rely on our reading. Update to the latest version and confirm in the plugin's changelog on its WordPress.org page that this issue is addressed.

Steps:

1. Back up your site. Use your host's backup tool or a plugin you already trust. Updates rarely break things, but a backup makes it painless if they do.
2. Go to Dashboard > Updates (or Plugins > Installed Plugins) and click Update now next to TrueBooker.
3. Recheck the version number and confirm it is higher than 1.2.3.
4. Open your booking page and make a test booking to confirm it still works.

With WP-CLI:

wp plugin update truebooker-appointment-booking

If you cannot update right now, deactivate the plugin until you can. Your booking form will go offline, which is a better trade than leaving an open door to your admin account:

wp plugin deactivate truebooker-appointment-booking

If a managed host runs your updates, ask them to confirm the version in writing.

How to check if someone already got in

Updating closes the hole. It does not undo anything that happened before. Spend ten minutes on this checklist:

• Check admin email addresses. Go to Users > All Users, filter by Administrator, and read each email. Any address you do not recognize is a red flag. Or run: wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
• Check other accounts too. Also scan the email addresses of Editors, Shop Managers and customer accounts, since the flaw is not limited to admins.
• Look for unknown admins. Any administrator you did not create, or with a recent registration date you cannot explain, needs investigating.
• Search your inbox (including spam) for 'Password Reset' or 'Email Changed' messages from WordPress that you did not request.
• Review plugins and themes. Look for ones you never installed, or recently modified files you cannot explain.
• Check your host's access logs, if you can reach them, for unusual POST requests to admin-ajax.php (or other plugin endpoints) from before and after 2026-09-16. The flaw exists in every version up to 1.2.3, so abuse could have started before the CVE was published. The sources do not name the exact endpoint, so treat this as a place to look, not proof either way. If logs make your eyes glaze over, that is normal. Skip this one and use the next step.

If you find something suspicious

1. Set every admin account's email back to a correct address, then change the password to a long, unique one.
2. In each affected user's profile (Users > All Users > Edit), click Log Out of All Sessions (it reads Log Out Everywhere Else on your own profile) so any stolen session ends.
3. Delete admin users you did not create.
4. Remove unknown plugins and reinstall WordPress core and plugins from clean copies.
5. Change your hosting, database and FTP/SFTP passwords too.

If you think the site is compromised, our website hacked guide walks through cleanup in order. Do not delete evidence first if you may need to tell customers or a client. Take a backup copy of the current state.

Extra steps that reduce your risk

These will not replace the update, but they make the next plugin bug less painful:

• Turn on automatic updates for plugins you rely on (Plugins > Installed Plugins > Enable auto-updates), at least for security-critical ones.
• Use two-factor authentication (2FA) for administrators. It adds a second check at login, which can limit what a stolen password alone can do. It is not a substitute for patching.
• Keep the admin list short. Day-to-day staff rarely need the Administrator role.
• Delete plugins you do not use. Fewer plugins means fewer places for a bug to hide.
• Watch security notices. Wordfence and similar services publish new WordPress plugin flaws; subscribing to alerts is free.

Wondering how exposed the rest of your site is? Our guide on whether your website is hackable explains the common weak spots, and the free website security check looks at what is visible from the outside.

Why plugin bugs like this keep happening

Booking plugins have to let anonymous visitors send requests, such as 'book me for Tuesday at 3pm'. That makes them a natural target. When a developer forgets to check 'is this person allowed to do this particular thing?' on one of those requests, you get a missing authorization bug like this one.

Automated scanners that compare plugin versions can often flag a known CVE like this one. They are much worse at spotting this kind of logic mistake in plugin or custom code. That is the reason a human reviewing how your site handles accounts and permissions still matters.

Key takeaways

• TrueBooker versions up to and including 1.2.3 are affected by CVE-2026-14349, rated Critical (CVSS 9.8) in the NVD.
• An attacker who is not logged in can change a user's email, including an admin's, then use a password reset to take over the account.
• Update the plugin to the latest version today, check the changelog, and deactivate it if you cannot update yet.
• After updating, review admin emails and users, and look for password reset emails you did not request.
• Use auto-updates, 2FA for admins, and a short list of plugins to limit the next surprise.

What to do next

If you patched and checked your admin accounts, you have handled the immediate risk. If you want a person to look at the rest of your site, our $49 Circuit audit is a manual, one-time review of your site with a written report listing each issue, its severity, evidence and the exact fix. It is a focused small-site audit, not a compliance certificate or a multi-week enterprise pentest. You can see the options on the pricing page, or start with the free check first.

Source: NVD entry for CVE-2026-14349.