Thirteen WordPress plugin flaws, eight need no login (CVE-2026-15014)

On July 28, 2026, thirteen WordPress extension (plugin) vulnerabilities were published in a single day. Eight of them can be exploited by an attacker who is not logged in at all. The worst is in "SMS Alert," which adds phone-number verification to online stores: an attacker verifies a code sent to their own phone, then simply swaps in the victim's number and is logged in as that person. Administrator accounts are not excluded.

The affected plugins are SMS Alert for phone verification, TrueBooker for appointment booking, Tablesome for tables, WP Fast Total Search for site search, Demi for demo import and backups, Better Messages for on-site chat, Database for Contact Form 7 for storing form submissions, FluentCart for online stores, Event Tickets and Registration for event ticketing, Quiz and Survey Master for surveys, Premium Packages for selling digital goods, and Bookly for appointment management — twelve plugins in all (TrueBooker accounts for two of the thirteen CVEs). Together they run on more than 300,000 sites.

The bottom line first: all thirteen already have fixed releases. But on one of them, trusting the published "affected versions" range will leave you exposed — that is Bookly, with 60,000+ installs, and we come back to it below. There are no reports of real-world attacks yet, and the severity varies widely. But sites with auto-updates turned off are still sitting on the old code. Below we sort the thirteen not by severity score but by whether the attacker needs to log in, because that is what actually decides the order you should fix them in. WordPress plugin flaws surface almost every week — four on July 23 and three admin-takeover cases on July 16 were published only days ago.

What happened across the thirteen

Rather than ranking these by severity, it is easier to decide what to do first by splitting them on whether the attacker needs an account. The ones that need no login are hit directly from the outside simply because the site is on the internet. The ones that assume administrator or editor rights only work for an insider, or for someone who has already taken over an account by other means.

Eight need no login. SMS Alert lets someone log straight in as another user, TrueBooker lets them rewrite another person's password, Tablesome lets them rewrite published posts and pages, and Demi lets them erase entire folders on the server. Four more — WP Fast Total Search, Bookly, Premium Packages and TrueBooker's second flaw — all let an attacker inject their own instructions into database queries and read what comes back. The remaining five require an administrator, editor, or registered customer account, so the blast radius is far narrower.

All thirteen are problems in plugins, not in WordPress core. Sites that do not have these installed are unaffected. Start by opening the Plugins screen in your admin area and checking whether any of these names appear and which version you are on. WordPress core also had a separate serious flaw in July, which we cover in our WordPress core vulnerability roundup.

Affected plugins and fixes at a glance

Here are all thirteen side by side so you can judge at a glance whether your site is affected, with the no-login cases listed first. If you fall under "affected," update to the "safe version" on the right. Install counts are the rounded figures published by WordPress.org.

The severity numbers come from CVSS, the shared 10-point scale for how serious a flaw is. Anything at 9.0 and above is the top "critical" tier and 7.0 and above is "high." This time SMS Alert and TrueBooker are both critical, with eight more in the high band. The remaining three are medium to low — not numbers to panic over.

The "Login" column is the privilege the attacker needs. "Not needed" means anyone on the internet can try it, and that is your real priority order. Conversely, the ones marked "Administrator" only work for somebody who can already act as an admin, so they are less urgent than the score suggests.

Who goes after this, and why

The first people to touch flaws like these are not out to get you personally. They are operations that sweep sites worldwide by machine, hunting for anywhere a freshly disclosed plugin is installed. The moment the technical detail is public, it can be dropped straight into an automated crawler, so a list of "sites that have it" exists within days. Whether the target pool is 600 sites or 90,000 barely matters to them.

What they do next is impersonate the administrator and repurpose the site as someone else's business asset. With SMS Alert they walk past the phone check and sign in as whichever member they picked; with TrueBooker they swap the admin password for one they know and walk in the front door; with Tablesome they overwrite an existing page and plant a redirect that sends search visitors somewhere else. Hijacked sites get resold, or rented out as an on-ramp to scam pages.

The trouble is that the loss does not stop with the site owner. Visitors type their details into fake login and checkout screens believing they are real, and if you run a store, member addresses and order histories go with it. With the Demi-style "delete a whole folder" flaw there is not even a profit motive — the site goes, the backups go, and there is nothing to restore from. Attacks on password-reset logic follow the same pattern as the Kirki admin takeover that hit 500,000 sites in May, where exploitation was confirmed after disclosure.

Fix the eight that need no login first

These eight are reachable directly from outside. If you run any of them, update before doing anything else.

CVE-2026-15014: SMS Alert lets anyone log in as another user

SMS Alert adds SMS-based identity checks and order notifications to WooCommerce stores. It is built by Cozy Vision Technologies of India and runs on 3,000+ sites.

The flaw (CVE-2026-15014) is that the record of "this person passed the phone check" was a single yes/no flag that was never tied to which phone number had actually been verified. The registration handler looked only at that flag before issuing an authentication cookie.

So the attack runs like this. The attacker requests a code for their own phone number and completes verification legitimately, which sets the flag. Then, with the flag still set, they resubmit the registration request with the phone field swapped to the victim's number. The plugin resolves that number to an account and issues an authentication cookie for it. Knowing a phone number is enough to become that person, administrators included. Severity is CVSS 9.8.

Versions 3.9.7 and below are affected; 3.9.8 contains the fix, which stores the verified number itself and compares it strictly, and also splits the shared flag into per-integration keys. Note the pattern: on July 1 the same plugin was found to allow an unauthenticated arbitrary password reset (CVE-2026-11387, also CVSS 9.8). That is twice in a month that the same authentication gate has given way. If you run a store holding member details and order history, follow the update with a look at your login records and user list.

CVE-2026-14545: TrueBooker lets anyone rewrite another account's password

TrueBooker is the plugin salons, studios, and professional practices use to take appointments through their site. The flaw (CVE-2026-14545) is that one of its front-end account handlers never checks whether the person changing a password actually owns that account.

Normally a password reset proves ownership by requiring a one-time link sent to the registered address. TrueBooker's handler skips that check entirely, so someone who is not logged in can name a target account and set a new password on it directly. Administrator accounts are not excluded. The victim typically finds out only when their own password stops working. Note that the CVE record carries no severity score at all — WPScan, who reported it, does not publish them. Our table uses the 9.8 shown on WPScan's own site, but some scanners will show no number here, or their own estimate.

Versions below 1.2.4 are affected, and updating to 1.2.4 or later (currently 1.2.6) resolves it. The write-up is on WPScan. But TrueBooker's problems do not stop here. Seven vulnerabilities have been published for this plugin in 2026, including this one — there is a dedicated section on it below. The install base is small at 600+, but this is plainly a plugin whose permission handling keeps springing leaks.

CVE-2026-14924: Tablesome lets anyone overwrite your published pages

Tablesome stores contact-form submissions as tables and embeds tables into posts. The flaw (CVE-2026-14924) is that one of the endpoints the browser calls behind the scenes (an AJAX action) has no login check, no capability check, and no nonce — the one-time token that proves a request is genuine.

As a result someone who is not logged in can create new published posts and, worse, name an existing post or page and overwrite its contents. Replace the body of your About or Pricing page and every visitor arriving from search reads it as genuine. Because no administrator account was stolen, nothing in the login logs looks unusual. Severity is CVSS 7.5.

Versions below 1.1.31 are affected and 1.1.31 or later (currently 1.2.9) is safe. That fixed release has been out for a good while, so sites with auto-updates on are already covered. The exposed ones are those frozen on an old version — and as of today, exactly where to hit them is public information. The WPScan advisory has the detail.

CVE-2026-12741: WP Fast Total Search lets anyone pull data out of the database

WP Fast Total Search replaces WordPress's built-in search with a faster indexed full-text search. At 1,000+ installs it is small, but it is valued on content-heavy sites. The flaw (CVE-2026-12741) is that the form_data[s] search parameter was handled loosely enough that whatever you type flows into the database query itself.

This class of flaw is called SQL injection. When a query is assembled by gluing user input into a string instead of passing it through placeholders that force it to be treated as plain text, typing a fragment of query syntax into the search box appends your own instructions to the real ones. The pre-fix code did run the glued string through an escaping helper, but that helper was for a different purpose and never quoted the value for SQL, so it offered no protection.

No login is required. Through the public search form, an attacker can extract what the database holds — member email addresses, password hashes and the like. Nothing can be written, which keeps severity at CVSS 7.5, but extracted credentials get recycled against other services.

Versions 1.80.280 and below are affected; 1.81.282 contains the fix, which routes the query fragments through prepared-statement placeholders. One trap in reading the changelog: the previous release, 1.80.280, carries the identical line "Fixed SQL injection vulnerability" — but that refers to a different, earlier issue, and this flaw is still present there. Do not judge by the changelog text; check that the version number is 1.81.282 or higher.

CVE-2026-14516: Bookly leaks customer data — and the published affected range is wrong

Bookly handles appointments and staff assignment for salons, clinics and studios, and at 60,000+ installs it is by far the most widely deployed plugin in this batch. The flaw (CVE-2026-14516) is that values in the staff_ids parameter, which selects which staff member a booking is for, land directly inside a database query.

Exploitation is a two-request chain. First an unauthenticated call to the booking-form initialiser seeds a session carrying a rigged staff_ids array; then a call to the slot-rendering endpoint drives that tainted value into the query. Neither endpoint validates a nonce, so the chain can be started cross-site, from a page the attacker controls, through a visitor's browser. It is a time-based extraction — data comes out a character at a time, judged by how long the response takes — so it is slow, but customer email addresses and booking history are in scope. Severity is CVSS 7.5.

Now the important part. The CVE's affected range reads 27.5 and below, which implies 27.6 fixed it. It did not. Comparing the shipped 27.5, 27.6 and 27.7 packages, the vulnerable code is byte-identical across all three; the integer cast that actually fixes it first appears in 27.8, released July 10, 2026. The 27.8 code even carries a comment noting that staff ids arrive unsanitised from the front-end form and flow into a raw SQL list.

So sites running 27.6 or 27.7 sit outside the published affected range and are exploitable anyway. Compounding it, Bookly's changelog lives on the vendor's own site and the 27.8 entry mentions no security fix at all. Both the affected-version range and the changelog will tell you that you are fine. If you run Bookly, check one thing only: is the version 27.8 or higher?

CVE-2026-12800: Premium Packages exposes the database through a coupon field

Premium Packages is the paid-sales add-on for WordPress Download Manager, the long-standing file-delivery plugin, built by W3 Eden. The flaw (CVE-2026-12800) is that the cart's coupon endpoint dropped the submitted coupon code straight into a database lookup. No login needed — typing query syntax into the coupon box is enough. Severity is CVSS 7.5.

The fix is in 7.0.0, and there is a reading trap here too. 7.0.0 was a ground-up rewrite in which the vulnerable file was deleted outright and replaced by code that binds the value safely. But the 7.0.0 changelog never mentions this flaw — the vendor was notified six days after 7.0.0 shipped, so it was fixed incidentally by the rewrite rather than in response to the report. The 7.0.5 changelog does list two security fixes, but they are different bugs. The current release is 7.0.5, so go there.

CVE-2026-14490: Demi lets anyone delete entire folders from the server

Demi imports demo site layouts in one click and also handles backups and server migrations. The flaw (CVE-2026-14490) starts with the plugin storing a signing key that should have been secret inside a publicly readable folder.

During a restore, the plugin passes progress state back and forth and uses a signature to confirm the instruction came from a legitimate step. That signing key, however, sat as a dot-file inside the public uploads folder, with no access rules blocking it. Anyone who grabs the key can mint valid signatures themselves — and the restore endpoint is registered for unauthenticated callers. Finally, the folder to be deleted is taken from the caller with no allow-list and no path canonicalisation, so any directory on the server can be deleted recursively, contents and all. Severity is CVSS 7.5.

Versions 0.0.7 and below are affected. Release 0.0.8 added access-protection rules to the temporary folder, but reading the vendor's changelog, the substantive fix — moving secrets out of the web root, closing the unauthenticated entry points, and hardening path checks — landed in 0.0.9. Go to 0.0.9. The install base is small at 300+, but since what gets deleted is the site and its backups, the loss when it lands is the largest on this list.

TrueBooker: seven CVEs in 2026, and what to do about it

TrueBooker needs its own section, because it is not like the others. Two of today's thirteen CVEs are in this one plugin. Alongside the password-rewrite flaw above, there is this.

CVE-2026-13161: the booking-lookup handler leaks the database

CVE-2026-13161 is a SQL injection in the appointment-update handler, where a user id flows unescaped into the query. At a glance the handler does check a nonce — but that nonce is printed on the public booking page where any unauthenticated visitor can read it, so it was never a barrier. Severity is CVSS 7.5.

The fix version is 1.2.3. Do not aim for 1.2.3. That release is itself vulnerable to two more flaws published five days earlier on July 23 — an unauthenticated SQL injection at 9.3 and an unauthenticated privilege escalation at 9.8. The first version clean of everything is 1.2.4, and the current release is 1.2.6.

*CVE-2026-14545 has no severity score in its CVE record; 9.8 is the figure shown on WPScan's site.

Seven in four months, four of them unauthenticated and scored 9 or above. They arrived from three different reporting organisations at three different times, which produces a pattern where you update, believe you are current, and another identifier lands. This article originally described the plugin as having had "two in two months" — the seventh was published hours later the same day and we rewrote it.

At that point the question stops being "which CVE" and becomes whether to keep running this plugin at all. The install base is small at 600+, and there are alternatives for the same job. If you keep it, move to 1.2.6, turn on auto-updates, and reconsider how much customer data you let it hold. Booking plugins are a favoured target — LatePoint, with 100,000 sites, had an admin-takeover flaw as well.

What the other five actually are

These five require an account of some kind. Some carry high scores, but their practical reach is narrower than the three above. Feel free to read only the entry for the plugin you use.

CVE-2026-16585: Better Messages can have its config file deleted and the server taken over

Better Messages adds member-to-member chat and group conversations to a site. The flaw (CVE-2026-16585) is weak validation of which paths the sticker-deletion routine is allowed to touch.

The check was a simple prefix match: if the URL starts with the uploads folder, allow it. So a URL that begins legitimately but embeds ../ traversal sequences later in the path slips straight through, because the URL-cleaning function used does not strip those sequences — the payload is stored verbatim and then acted on. The destination that matters is wp-config.php, the file holding WordPress's database credentials. Delete it and WordPress falls back to its setup screen, where an attacker can attach their own database and take the site over. Severity is CVSS 7.2.

Exploitation requires administrator rights, so this is not something reachable from outside. Versions 2.15.19 and below are affected; 2.15.20 contains the fix, visible in the vendor's source changeset. The changelog does not mention the security fix, so do not dismiss the release as unrelated housekeeping. The report comes from Wordfence.

CVE-2026-14870: Database for Contact Form 7 turns one clicked link into a takeover

This plugin stores submissions from Contact Form 7, WPForms and Elementor forms inside the site, and runs on more than 60,000 installs. The flaw (CVE-2026-14870) is that an admin page reflected a parameter back into the output without escaping it — a reflected script-injection issue.

The attacker crafts an admin-area URL carrying a rigged value and gets an administrator to open it. The moment it loads, the attacker's code runs in that administrator's browser and with their rights — adding a new administrator account, for instance. The attacker needs no login of their own, but they do need to talk an admin into clicking, which makes it different in kind from the ones that can be harvested automatically. Severity is CVSS 7.1. Versions below 1.5.3 are affected; for the reason explained below, go to 1.5.5.

CVE-2026-14926: FluentCart lets a customer meddle with someone else's subscription

FluentCart is a relatively new plugin that adds e-commerce to WordPress, subscriptions included. The flaw (CVE-2026-14926) is that several payment-method endpoints never verify that the subscription belongs to the person acting on it.

Anyone registered on the same site who knows another customer's subscription identifier can change that subscription's payment method, or cancel and re-bind it. Identifiers are often sequential, so working through them can pay off. It touches money directly, but exploitation requires a customer account and targets one victim at a time, which keeps severity at CVSS 4.2. Versions below 1.4.0 are affected; here too, 1.5.3 or later (currently 1.5.5) is the safer target.

CVE-2026-14819: Event Tickets lets an editor go after higher-privileged users

Event Tickets and Registration handles event sign-ups and ticket sales, and at 90,000+ installs it is the largest plugin in this batch. Its stablemate event calendar plugin had a separate data-exposure flaw published in July.

This flaw (CVE-2026-14819) is insufficient escaping of event titles when they are written into a ticket history log, so code planted in a title is stored and later executed. It requires Editor rights or above and only works on multisite installations. Despite the large install base, very few sites meet both conditions, and severity sits at a low CVSS 3.5. Versions below 5.28.4 are affected; the current release is 5.29.1.

CVE-2026-14821: Quiz and Survey Master lets a contributor delete your templates

Quiz and Survey Master is a long-standing plugin for building quizzes and surveys, with 40,000+ installs. The flaw (CVE-2026-14821) is a missing capability check on the routine that deletes output templates, so even a contributor-level user can delete them at will.

What is lost is presentation configuration — no member data leaks and no server is seized. Severity is CVSS 2.7, the lowest of the thirteen. If you hand contributor accounts to outside writers, moving to 11.1.5 or later (currently 11.2.2) is enough. The WPScan listing collects the plugin's earlier reports too.

For three of these, the listed fix is not the end of it

There is one trap when you sit down to update. For three of these plugins, moving to the version that fixes today's CVE still leaves a more recently disclosed flaw in place. That is why some "safe version" entries in the table above are ahead of the actual fix release.

FluentCart's later issue in particular exposes customers' personal details with no login at all, which is more likely to cause real harm than today's CVE-2026-14926 (customer account required, 4.2). If you run a store, do not stop at 1.4.0 — go to 1.5.3 or later.

This "I patched it but I am still not current" effect is common. Disclosure usually trails the fixed release by days or months, and by then the next version is out. The heaviest case, though, is Bookly. That one is not even a later flaw: the affected-version range in the CVE itself is wrong, and 27.6 and 27.7 — both nominally out of scope — are exploitable. 60,000 sites, and the changelog says nothing about security either. There is a cousin of this trap in WP Fast Total Search. That one is not a later flaw but a misleading changelog: the vulnerable 1.80.280 also says "Fixed SQL injection vulnerability." Trust the wording and you leave the hole open. So chasing the version numbers written in CVE records is slower and less reliable than simply moving to whatever the current release is. We made the same point about the Ninja Forms flaw that covered 600,000 sites: reading only the affected-version range is a good way to feel safe while staying exposed.

What to do right now

The steps are simple. Work through them from your admin area in this order.

Where to look during the inspection depends on the flaw. If you ran SMS Alert, check the member list for accounts you do not recognise and your administrator accounts for sign-ins you cannot account for. If you ran TrueBooker, check the Users list for administrators you do not recognise, and confirm your own password still works. If you ran Bookly, Premium Packages, WP Fast Total Search or TrueBooker, note that database-read attacks change nothing visible — the only trace is in access logs, so if you hold customer data, prompt a password reset after updating. If you ran Tablesome, check the body of static pages you rarely open — About, Pricing, Contact. None of those attacks requires stealing an administrator account, so login history alone will show nothing odd. If you ran Demi, check first that your backup destination has not been emptied.

None of the thirteen appear in CISA's catalogue of vulnerabilities confirmed to be under attack (KEV). So we are not yet at the "already being hunted" stage. But KEV only lists something once attacks have been observed, and by then you are reacting rather than preparing. Finishing the update now, right after disclosure, is the cheapest version of this problem you will get.

For everyday hygiene it comes down to deleting the plugins you do not use and enabling auto-updates on the ones you keep. We have made the "installed and forgotten is the real risk" point repeatedly in earlier WordPress plugin vulnerability roundups. If you also pull third-party components into a custom theme or bespoke code, running them through a dependency scanner will catch the gaps that sit outside the plugin list.

Summary

Of the thirteen published on July 28, 2026, the urgent ones are the eight that need no login. SMS Alert lets an attacker log straight in as another member (CVSS 9.8), TrueBooker lets them rewrite the administrator's password (also 9.8), Tablesome lets them overwrite live pages, WP Fast Total Search lets them read the database, and Demi lets them erase whole folders. Bookly (60,000 sites), Premium Packages and TrueBooker's second flaw all let an unauthenticated attacker read the database. The other five presuppose an administrator, editor, or customer account and are less pressing than their scores imply. The two with the biggest install bases — Event Tickets and Quiz and Survey Master — both turned out to be low-severity issues with narrow preconditions.

Fixed releases exist for all thirteen, and the work itself takes minutes from the admin screen. Three things to watch. First Bookly: the published range says "27.5 and below", but 27.7 is still exploitable — check only whether you are on 27.8 or higher. Second, Database for Contact Form 7, FluentCart and Event Tickets each leave a newer flaw open if you stop at today's fix version. And WP Fast Total Search repeats the same "Fixed SQL injection vulnerability" line on the release that is still vulnerable, so verify by version number rather than changelog text. And TrueBooker has now had seven CVEs published in 2026 alone, which makes it a question of whether to keep the plugin at all. Rather than matching version numbers precisely, move to the current release. We will update this article if exploitation or a KEV listing is confirmed.

Sources

• ▸ NVD - CVE-2026-15014 (SMS Alert)
• ▸ NVD - CVE-2026-14516 (Bookly)
• ▸ NVD - CVE-2026-12800 (Premium Packages)
• ▸ NVD - CVE-2026-13161 (TrueBooker, second flaw)
• ▸ Bookly - vendor changelog
• ▸ Patchstack - TrueBooker vulnerability list
• ▸ NVD - CVE-2026-12741 (WP Fast Total Search)
• ▸ NVD - CVE-2026-11387 (SMS Alert, the separate July 1 flaw)
• ▸ NVD - CVE-2026-14545 (TrueBooker)
• ▸ NVD - CVE-2026-14924 (Tablesome Table)
• ▸ NVD - CVE-2026-14490 (Demi)
• ▸ NVD - CVE-2026-16585 (Better Messages)
• ▸ NVD - CVE-2026-14870 (Database for Contact Form 7)
• ▸ NVD - CVE-2026-14926 (FluentCart)
• ▸ NVD - CVE-2026-14819 (Event Tickets and Registration)
• ▸ NVD - CVE-2026-14821 (Quiz and Survey Master)
• ▸ WPScan - TrueBooker < 1.2.4 Unauthenticated Arbitrary Password Reset
• ▸ WPScan - Tablesome Table < 1.1.31 Unauthenticated Post Creation/Overwrite
• ▸ Wordfence Intelligence - Better Messages <= 2.15.19 Arbitrary File Deletion
• ▸ WordPress.org Plugin Trac - Better Messages fix diff (changeset 3623636)
• ▸ Patchstack - TrueBooker <= 1.1.9 Broken Access Control (CVE-2026-48881)
• ▸ WordPress.org - Demi plugin changelog
• ▸ Wordfence Intelligence - WordPress plugin vulnerability database