CVE-2026-14349: Critical TrueBooker WordPress Plugin Auth Bypass Enables Admin Account Takeover — Detection and Remediation Guide

NVD has published CVE-2026-14349, a CVSS 9.8 (Critical), network-exploitable authorization bypass in the TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, affecting all versions up to and including 1.2.3. The plugin fails to properly verify that a user is authorized to perform a sensitive action, allowing unauthenticated attackers to modify the email address of arbitrary user accounts — including administrators. Once an attacker controls the email address on an account, the standard WordPress password reset flow hands them the keys: request a reset, receive the link at the attacker-controlled mailbox, and log in as admin.

This is not a theoretical chaining scenario. "Change my email, then reset my password" is one of the most reliable account takeover primitives in the WordPress ecosystem because it requires no code execution, no file upload, and no valid credentials — just an unauthenticated request to an exposed AJAX or REST handler. Any organization running TrueBooker at version 1.2.3 or earlier should treat this as an emergency patch event and assume Internet-wide scanning began the day the CVE record went public.

Technical Analysis

Affected Products and Versions

How the Vulnerability Works

This is a classic broken access control / missing authorization flaw (CWE-862 class), the single most common vulnerability pattern in WordPress plugins. WordPress plugins typically expose functionality through admin-ajax.php (registered via wp_ajax_ and, critically, wp_ajax_nopriv_ hooks) or through custom REST API routes under /wp-json/. When a developer registers a nopriv handler — making the action reachable by unauthenticated visitors — they are responsible for enforcing authorization inside the handler. TrueBooker's email-modification action does not do so.

The attack chain from a defender's perspective:

1. Reconnaissance: Attacker enumerates sites running TrueBooker (plugin paths like /wp-content/plugins/truebooker/ are trivially fingerprintable) and identifies target user accounts — admin or any enumerated username via /wp-json/wp/v2/users or author archive pages.
2. Email overwrite: Attacker sends a crafted unauthenticated request (typically a POST to /wp-admin/admin-ajax.php with a TrueBooker action parameter, or to a plugin REST route) supplying the victim's user ID/login and a new attacker-controlled email address. The plugin updates wp_users.user_email without validating a nonce, capability, or session.
3. Password reset: Attacker requests a password reset at /wp-login.php?action=lostpassword for the victim account. WordPress mails the reset link to the new (attacker-controlled) address.
4. Account takeover: Attacker sets a new password and authenticates. If the victim is an administrator, the attacker now has full site control — theme/plugin editor access for webshell deployment, user creation for persistence, and content/database access.

Key exploitation characteristics that shape detection:

• Exploitation requires only HTTP access to the site — no credentials, no user interaction.
• The malicious request looks like ordinary web traffic at the network layer; the tell is the action/route and parameter combination, plus the database-side artifact (an email change with no legitimate session).
• The follow-on password reset and login generate highly detectable events in WordPress logs, web server access logs, and mail logs.

Exploitation Status

At the time of writing, CVE-2026-14349 has been published by NVD with a Critical rating and full technical description. It has not yet been listed in the CISA Known Exploited Vulnerabilities catalog, but defenders should not wait for KEV inclusion to act. WordPress plugin authorization bypasses with unauthenticated account-takeover impact are historically among the fastest to be weaponized once disclosed — automated scanners and exploit modules for this exact bug class routinely appear within days of publication. Treat this as exploitation-imminent and remediate on an emergency change window.

Detection & Response

Detection for this flaw spans three layers: the web request (identifying attempts to reach the vulnerable handler), the application/database side effect (an unexpected user_email change), and the follow-on takeover behavior (password resets and anomalous logins). Prioritize the side-effect and post-exploitation detections — they are lower-noise and catch exploitation even if the exact vulnerable endpoint varies by plugin version.

Sigma Rules

---
title: TrueBooker WordPress Plugin Unauthenticated Email Modification Attempt - CVE-2026-14349
id: 3c7a2f91-6b4d-4e58-9a1c-8f2d5e6b7a90
status: experimental
description: Detects HTTP requests targeting TrueBooker plugin AJAX/REST endpoints with email or user-modification parameters, consistent with exploitation of CVE-2026-14349 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14349
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/truebooker'
      - '/wp-content/plugins/truebooker/'
  selection_params:
    cs-uri-query|contains:
      - 'truebooker'
      - 'user_email'
      - 'new_email'
      - 'update_user'
      - 'user_id'
  condition: selection_uri and selection_params
falsepositives:
  - Legitimate TrueBooker appointment booking traffic — review parameter combinations and source reputation
level: high
---
title: WordPress Password Reset Request Immediately Following User Email Change
id: 8e1b4c62-3d7f-4a29-b5e6-1c9a3f7d2e48
status: experimental
description: Detects password reset requests against wp-login.php originating from a source that also triggered user-modification requests, indicating the second stage of a CVE-2026-14349 account takeover chain.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14349
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1078
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains: '/wp-login.php'
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'action=lostpassword'
      - 'action=rp'
      - 'action=resetpass'
  filter_admin:
    c-ip|startswith:
      - '10.'
      - '192.168.'
  condition: selection and not filter_admin
falsepositives:
  - Legitimate user password resets — correlate with preceding requests to admin-ajax.php or truebooker routes from the same source IP
level: medium
---
title: Successful WordPress Admin Login From Untrusted Source After Password Reset
id: 5f2d8a17-9c3e-4b61-a7d4-2e6b8c1f9a35
status: experimental
description: Detects successful WordPress authentication events from external IP addresses for privileged accounts, a post-exploitation indicator of CVE-2026-14349 account takeover.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14349
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1078
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains: '/wp-login.php'
    cs-method: 'POST'
    sc-status: 302
  filter_known:
    c-ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection and not filter_known
falsepositives:
  - Administrators logging in from remote/VPN connections — maintain an allowlist of known admin source ranges and investigate all others
level: high

KQL (Microsoft Sentinel / Defender)

The following hunt queries assume Apache/Nginx/WordPress logs are ingested into Sentinel via Syslog/CEF, and that you are hunting for both the exploitation attempt and the takeover chain. The first query finds suspicious TrueBooker handler requests; the second correlates email-modification requests with subsequent password resets from the same source — the highest-fidelity behavioral indicator of this attack.

// Hunt 1: Requests targeting TrueBooker plugin endpoints with user/email modification parameters
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL contains "admin-ajax.php" or RequestURL contains "truebooker"
| where RequestURL has_any ("truebooker", "user_email", "new_email", "update_user", "user_id")
| summarize RequestCount = count(),
            DistinctURLs = dcount(RequestURL),
            SampleURLs = make_set(RequestURL, 10)
  by SourceIP, DestinationHostName, bin(TimeGenerated, 1h)
| order by RequestCount desc

// Hunt 2: Same source IP hitting user-modification endpoints AND wp-login.php password reset within 1 hour
let window = 1h;
let EmailChange =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL contains "admin-ajax.php" or RequestURL contains "truebooker"
    | where RequestURL has_any ("user_email", "new_email", "update_user")
    | project ChangeTime = TimeGenerated, SourceIP, DestinationHostName, RequestURL;
let PwdReset =
    CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where RequestURL contains "wp-login.php"
    | where RequestURL has_any ("lostpassword", "resetpass", "action=rp")
    | project ResetTime = TimeGenerated, SourceIP, DestinationHostName;
EmailChange
| join kind=inner PwdReset on SourceIP, DestinationHostName
| where ResetTime between (ChangeTime .. ChangeTime + window)
| project SourceIP, DestinationHostName, ChangeTime, ResetTime, RequestURL
| order by ChangeTime desc

// Hunt 3: Syslog-ingested Apache/Nginx access logs for sites without CEF normalization
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has "admin-ajax.php" or SyslogMessage has "wp-login.php"
| where SyslogMessage has_any ("truebooker", "user_email", "new_email", "lostpassword", "resetpass")
| extend SourceIP = extract(@"(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| summarize Hits = count(), Samples = make_set(SyslogMessage, 5) by SourceIP, Computer, bin(TimeGenerated, 1h)
| order by Hits desc

Velociraptor VQL

For endpoint forensics on the WordPress host itself, hunt for the vulnerable plugin version and recently modified user/email artifacts. This artifact enumerates installed TrueBooker versions across web roots and surfaces webshell-style indicators in the plugin directory that may indicate post-takeover payload deployment.

-- Identify TrueBooker plugin installs, versions, and recently dropped PHP files (potential webshells post-takeover)
LET plugin_dirs = SELECT FullPath
FROM glob(globs=[
  '/var/www/**/wp-content/plugins/truebooker*/readme.txt',
  '/var/www/**/wp-content/plugins/truebooker*/truebooker.php',
  'C:/inetpub/**/wp-content/plugins/truebooker*/readme.txt'
])

LET recent_php = SELECT FullPath, Mtime, Size
FROM glob(globs=[
  '/var/www/**/wp-content/plugins/truebooker*/**.php',
  '/var/www/**/wp-content/uploads/**.php'
])
WHERE Mtime > now() - 86400 * 14

SELECT * FROM plugin_dirs
UNION ALL
SELECT FullPath, Mtime, Size FROM recent_php

-- Separately: inspect outbound password-reset mail events and wp-login activity from host logs
SELECT FileName, Line
FROM foreach(
  row={
    SELECT FullPath AS FileName
    FROM glob(globs=['/var/log/apache2/access*.log', '/var/log/nginx/access*.log'])
  },
  query={
    SELECT FileName, Line
    FROM parse_lines(filename=FileName)
    WHERE Line =~ 'truebooker|user_email|new_email|lostpassword|resetpass'
  })

Remediation & Verification Script

Run the following on Linux web hosts (or via your configuration management tooling) to inventory TrueBooker installations, identify vulnerable versions, and — where the plugin cannot be updated immediately — disable it as an interim measure. Disabling a booking plugin will impact scheduling functionality; weigh that against an unauthenticated admin-takeover primitive exposed to the Internet.

#!/bin/bash
# CVE-2026-14349 — TrueBooker <= 1.2.3 auth bypass: inventory, verify, mitigate
# Run as root or with sudo on WordPress hosts.

VULN_MAX="1.2.3"
WP_ROOTS=("/var/www" "/srv/www" "/home")

echo "=== CVE-2026-14349 TrueBooker exposure scan ==="

for root in "${WP_ROOTS[@]}"; do
  [ -d "$root" ] || continue
  find "$root" -type d -path "*/wp-content/plugins/truebooker*" 2>/dev/null | while read -r pdir; do
    main=$(find "$pdir" -maxdepth 1 -name "*.php" | head -1)
    ver=$(grep -m1 -i "Version:" "$main" 2>/dev/null | awk '{print $NF}')
    echo "[FOUND] $pdir  version=${ver:-unknown}"

    if [ -n "$ver" ] && [ "$(printf '%s\n%s\n' "$ver" "$VULN_MAX" | sort -V | head -1)" != "$VULN_MAX" -o "$ver" = "$VULN_MAX" ]; then
      echo "  [VULNERABLE] version $ver <= $VULN_MAX"
      # Interim mitigation: deactivate the plugin if wp-cli is available
      wpconf=$(dirname "$(dirname "$(dirname "$pdir")")")
      if command -v wp >/dev/null 2>&1; then
        wp --path="$wpconf" --allow-root plugin deactivate "$(basename "$pdir")" \
          && echo "  [MITIGATED] plugin deactivated pending patch" \
          || echo "  [WARN] wp-cli deactivate failed — remove or block manually"
      else
        echo "  [ACTION] wp-cli not found — deactivate via wp-admin or rename: mv \"$pdir\" \"$pdir.disabled\""
      fi
    elif [ -n "$ver" ]; then
      echo "  [OK] version $ver appears patched (verify against vendor advisory)"
    fi
  done
done

echo "=== Checking for indicators of exploitation in access logs (last 14 days) ==="
for log in /var/log/apache2/access*.log /var/log/nginx/access*.log; do
  [ -f "$log" ] || continue
  hits=$(zgrep -hE 'truebooker|user_email|new_email|update_user' "$log" 2>/dev/null | grep -E 'admin-ajax|wp-json' | wc -l)
  [ "$hits" -gt 0 ] && echo "[IOCs] $log: $hits suspicious TrueBooker requests — review for exploitation"
done

echo "=== Review wp_users for unexpected email changes (requires DB creds) ==="
echo "Run: SELECT ID,user_login,user_email,user_registered FROM wp_users ORDER BY ID;"
echo "Cross-reference admin account email addresses against expected values."

Remediation

1. Update the TrueBooker plugin immediately. Check the WordPress plugin repository and the vendor's advisory for the fixed release; any version at or below 1.2.3 is vulnerable. If no patched version is available yet, deactivate and remove the plugin until one ships — there is no configuration workaround for a missing authorization check in a nopriv handler.
2. Audit wp_users for unauthorized email changes. Compare user_email values for all privileged accounts against your IdP/HR records. Pay particular attention to administrator accounts whose email domain you don't recognize. If any account's email was changed unexpectedly, treat it as a confirmed compromise.
3. Force credential resets. If the plugin was exposed and unpatched, reset passwords for all WordPress administrator and editor accounts, invalidate all sessions (rotate AUTH_KEY/SECURE_AUTH_KEY and the remaining salts in wp-config.php — this kills every active session cookie), and enforce MFA on all privileged accounts.
4. Hunt before you assume clean. Review web access logs for the patterns in the detections above: requests to admin-ajax.php or TrueBooker REST routes containing user/email parameters, followed by wp-login.php?action=lostpassword from the same source. If the chain is present, escalate to incident response: check for new admin users, modified theme/plugin files (the built-in editor is the classic webshell path post-admin-takeover), unexpected cron entries, and outbound connections from the web server.
5. Apply compensating controls going forward. Restrict admin-ajax.php and /wp-json/ exposure where business logic allows (WAF rules, or IP-restrict /wp-admin and wp-login.php for administrative users). Deploy a WordPress audit/logging plugin (or forward application logs to your SIEM) that captures user profile modifications and password reset events — this bug class is invisible without application-layer telemetry.
6. Track CISA KEV. Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14349) and the CISA KEV catalog for confirmed exploitation status and any federal remediation deadline; update your patch SLA accordingly if it lands in KEV.

The broader lesson for vulnerability management teams: broken access control in WordPress plugins is the highest-volume, lowest-effort attack surface in most web estates. Your CMS plugin inventory should be treated with the same rigor as your operating system patch program — including automated version enumeration, virtual patching capability at the WAF, and a documented kill-switch process for deactivating plugins under active exploitation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub