PT-2026-65390 · Undefined · Undefined

Pedro Pinho · CVE-2026-14545 · Publicado 2026-07-28 · Atualizado 2026-07-28

NVD

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-14545

Produtos afetados

Undefined

Referências · 2

• 🔥 https://wpscan.com/vulnerability/c97d9841-2bd7-438b-a719-7943d671c754 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14545 · Nota de Segurança