CVE-2026-14545

9.8 Critique

Publiée le 28/07/2026 à 09:16 · Modifiée le 28/07/2026 à 18:07 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Traduire en français

Produits concernés

Unknown TrueBooker

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.8 Critique	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-269

Références

https://wpscan.com/vulnerability/c97d9841-2bd7-438b-a719-7943d671c754/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories