CVE-2026-14545

The CVE concerns the TrueBooker WordPress plugin prior to 1.2.4. It allows unauthenticated attackers to reset passwords without verifying account ownership via a front-end password reset flow, enabling takeover of any account (including admin). Root cause is lack of ownership validation in the pa...