TrueBooker Plugin Lacks Account Ownership Validation in Password Reset

The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing unauthenticated attackers to set an arbitrary password on any account, including an administrator, and take over the site.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The TrueBooker WordPress plugin before version 1.2.4 contains a critical authentication bypass vulnerability that allows unauthenticated attackers to reset passwords for any user account without verifying ownership. By exploiting the plugin's front-end account handlers, attackers can set arbitrary passwords on administrator accounts and gain complete control of the WordPress site. This vulnerability affects all WordPress installations using the vulnerable plugin versions, putting millions of websites at risk of unauthorized administrative access, data theft, and malware deployment.

Casky's 224 matched security skills leverage Claude's extended reasoning to identify the attack patterns associated with this vulnerability through MITRE ATT&CK technique TA0004 (Privilege Escalation). Practitioners using Casky would observe detections for unauthorized account modifications, particularly unauthenticated requests to password reset handlers that bypass ownership validation checks. The platform's skills would flag suspicious patterns such as multiple failed authentication attempts followed by successful account takeovers, password changes originating from unexpected IP addresses, and rapid privilege escalation from unauthenticated to administrator status. By mapping these behavioral indicators to the underlying CWE-269 (Improper Access Control) weakness, Casky enables security teams to identify exploitation attempts in real-time and distinguish malicious password reset requests from legitimate user account recovery actions.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-14545.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-14545

Casky has 224 skills that investigate the attack patterns behind CVE-2026-14545. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn