Loading story…
A critical vulnerability tracked as CVE-2026-14364 affects the TrueBooker – Appointment Booking and Scheduler System WordPress plugin and allows unauthenticated attackers to reset passwords for arbitrary accounts, including administrators. The flaw impacts versions up to and including 1.2.3 and stems from improper password reset validation, classified as CWE-640. The issue carries a CVSS v3.1 rating of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting high risk of full account takeover and broad impact on confidentiality, integrity, and availability.
Technical details indicate the weakness is tied to the unauthenticated AJAX action wp_ajax_nopriv_user_front_resetpass, where the plugin's userresetPassword() logic uses user_activation_key and wp_set_password() in a way that can permit unauthorized resets. Public detection material has already appeared, including a Nuclei template and references to exploit code, while version-checking guidance points to the plugin readme.txt for identifying exposed installations. Available evidence shows 1.2.4 is not vulnerable, indicating the issue was addressed in that release.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Security researchers received CVE-2026-14364 for the TrueBooker – Appointment Booking and Scheduler System WordPress plugin. The issue allows unauthenticated arbitrary password resets affecting versions up to and including 1.2.3.
A Nuclei template pull request documented detection logic for CVE-2026-14364 and referenced exploit material. Validation showed the template successfully identified a test instance running TrueBooker 1.2.3 as vulnerable.
Technical validation associated with detection content indicates TrueBooker version 1.2.4 is not vulnerable, while 1.2.3 remains affected. This implies the password reset issue was fixed by version 1.2.4.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical unauthenticated privilege-escalation flaw, **CVE-2026-75816** (CVSS 9.8), affects the Frontend Admin by DynamiApps WordPress plugin, distributed under the `acf-frontend-form-element` slug. The vulnerability affects versions through **3.29.12** and stems from missing capability checks and an authorization bypass when non-numeric user or post identifiers are supplied. An unauthenticated attacker can alter arbitrary users’ email addresses, then invoke WordPress’s password-reset process to seize an administrator account and fully compromise the affected site. DynamiApps remediated the issue in version **3.29.13**; administrators should update immediately and review user email changes and password-reset activity. No active exploitation was reported at publication.
Sep 6, 2026
A critical authentication bypass vulnerability, tracked as **`CVE-2026-15826`**, affects the WordPress plugin **User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor** in versions up to and including **`3.16.4`**. The flaw carries a **CVSS 9.8** rating and stems from a type confusion bug in the plugin’s autologin flow: a `WP_Error` returned by `wp_insert_user()` can be passed through `absint()` before error handling, coercing the value to integer `1`. An unauthenticated attacker can exploit this by registering with a username between **61 and 70 characters**, causing the plugin to generate an autologin nonce for **user ID 1**, which is commonly the site administrator. Successful exploitation can result in full administrative takeover of affected WordPress sites, particularly where **user ID 1** still belongs to an administrator account. Reports said roughly **40,000 sites** were exposed. The issue was patched in **`3.16.5`**, and defenders were urged to update immediately, review administrator accounts for unauthorized access, and verify whether the default administrator mapping to user ID 1 remains in place. Wordfence said firewall protections were released first to paid customers and later to free users.
Aug 17, 2026
A critical vulnerability in the **Kirki – Freeform Page Builder, Website Builder & Customizer** WordPress plugin is being actively exploited to take over administrator accounts on vulnerable sites. The flaw, tracked as **`CVE-2026-8206`** and rated **CVSS 9.8**, affects versions **6.0.0 through 6.0.6** and stems from a password-reset REST API that accepts an attacker-supplied email address even when the target account is identified by username. By submitting a privileged username and an email address they control, an unauthenticated attacker can obtain a valid password reset link, reset the victim’s password, and seize the account. Researchers estimate roughly **150,000** sites may be exposed among more than **500,000** active installations, and Wordfence reported blocking **59** attack attempts in a 24-hour period.
Jun 29, 2026