Plugin de WordPress permite a atacantes cambiar contraseñas de administrador sin autenticación

Ciberseguridadlatam •Redacción CSL • August 9, 2026

Alerta CVE-2026-14365 expone a sitios con TrueBooker a toma de control total por falta de verificación de permisos en función crítica Una vulnerabilidad clasificada como crítica por el National Vulnerability Database permite a atacantes sin credenciales modificar contraseñas de cualquier cuenta en sitios WordPress que ejecuten el plugin TrueBooker – Appointment Booking and Scheduler System. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical WordPress Plugin Vulnerability Allows Admin Password Reset Without Authentication A critical vulnerability (CVE-2026-14365) in the TrueBooker plugin for WordPress enables attackers to reset administrator passwords without authentication. This flaw affects all sites using the TrueBooker – Appointment Booking and Scheduler System plugin, allowing unauthorized access and potential total control of the affected sites. The vulnerability was published on August 7, 2026, and is classified as critical by the National Vulnerability Database. Attackers can exploit this flaw remotely, posing a significant risk to website security. Site administrators are urged to take immediate action to mitigate this risk. The exact number of affected sites is currently unknown, but the potential impact is substantial given the plugin's widespread use. 6 sources 73

Extracted Entities

Plugin de WordPress permite a atacantes cambiar contraseñas de administrador sin autenticación

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

Platforms (1)