Eight WordPress plugin flaws, three exploitable with no login (CVE-2026-14545)

On July 28, 2026, eight WordPress extension (plugin) vulnerabilities were published at once. Three of them can be exploited by an attacker who is not logged in at all, and the most dangerous one lets someone rewrite the administrator's password on the booking plugin "TrueBooker." Once that password is changed, the whole site belongs to somebody else.

The affected plugins are TrueBooker for appointment booking, Tablesome for tables, Demi for demo import and backups, Better Messages for on-site chat, Database for Contact Form 7 for storing form submissions, FluentCart for online stores, Event Tickets and Registration for event ticketing, and Quiz and Survey Master for surveys. Together they run on more than 200,000 sites.

The bottom line first: all eight already have fixed releases. There are no reports of real-world attacks yet, and the severity varies widely. But sites with auto-updates turned off are still sitting on the old code. Below we sort the eight not by severity score but by whether the attacker needs to log in, because that is what actually decides the order you should fix them in. WordPress plugin flaws surface almost every week — four on July 23 and three admin-takeover cases on July 16 were published only days ago.

What happened across the eight

Rather than ranking these by severity, it is easier to decide what to do first by splitting them on whether the attacker needs an account. The ones that need no login are hit directly from the outside simply because the site is on the internet. The ones that assume administrator or editor rights only work for an insider, or for someone who has already taken over an account by other means.

Three need no login. TrueBooker lets someone rewrite another person's password, Tablesome lets them rewrite published posts and pages, and Demi lets them erase entire folders on the server. The remaining five require an administrator, editor, or registered customer account, so the blast radius is far narrower.

All eight are problems in plugins, not in WordPress core. Sites that do not have these installed are unaffected. Start by opening the Plugins screen in your admin area and checking whether any of these names appear and which version you are on. WordPress core also had a separate serious flaw in July, which we cover in our WordPress core vulnerability roundup.

Affected plugins and fixes at a glance

Here are all eight side by side so you can judge at a glance whether your site is affected. If you fall under "affected," update to the "safe version" on the right. Install counts are the rounded figures published by WordPress.org.

The severity numbers come from CVSS, the shared 10-point scale for how serious a flaw is. Anything at 9.0 and above is the top "critical" tier and 7.0 and above is "high." This time only TrueBooker is critical, with four more in the high band. The remaining three are medium to low — not numbers to panic over.

The "Login" column is the privilege the attacker needs. "Not needed" means anyone on the internet can try it, and that is your real priority order. Conversely, the ones marked "Administrator" only work for somebody who can already act as an admin, so they are less urgent than the score suggests.

Who goes after this, and why

The first people to touch flaws like these are not out to get you personally. They are operations that sweep sites worldwide by machine, hunting for anywhere a freshly disclosed plugin is installed. The moment the technical detail is public, it can be dropped straight into an automated crawler, so a list of "sites that have it" exists within days. Whether the target pool is 600 sites or 90,000 barely matters to them.

What they do next is impersonate the administrator and repurpose the site as someone else's business asset. With TrueBooker they swap the admin password for one they know and walk in the front door; with Tablesome they overwrite an existing page and plant a redirect that sends search visitors somewhere else. Hijacked sites get resold, or rented out as an on-ramp to scam pages.

The trouble is that the loss does not stop with the site owner. Visitors type their details into fake login and checkout screens believing they are real, and if you run a store, member addresses and order histories go with it. With the Demi-style "delete a whole folder" flaw there is not even a profit motive — the site goes, the backups go, and there is nothing to restore from. Attacks on password-reset logic follow the same pattern as the Kirki admin takeover that hit 500,000 sites in May, where exploitation was confirmed after disclosure.

Fix the three that need no login first

These three are reachable directly from outside. If you run any of them, update before doing anything else.

CVE-2026-14545: TrueBooker lets anyone rewrite another account's password

TrueBooker is the plugin salons, studios, and professional practices use to take appointments through their site. The flaw (CVE-2026-14545) is that one of its front-end account handlers never checks whether the person changing a password actually owns that account.

Normally a password reset proves ownership by requiring a one-time link sent to the registered address. TrueBooker's handler skips that check entirely, so someone who is not logged in can name a target account and set a new password on it directly. Administrator accounts are not excluded. The victim typically finds out only when their own password stops working. Severity is the top-tier CVSS 9.8.

Versions below 1.2.4 are affected, and updating to 1.2.4 or later (currently 1.2.6) resolves it. The write-up is on WPScan. Worth noting: on June 2 the same plugin had a separate no-login privilege bypass (CVE-2026-48881, CVSS 9.1) — twice in two months. The install base is small at 600+, but it is clearly a plugin whose permission handling keeps springing leaks.

CVE-2026-14924: Tablesome lets anyone overwrite your published pages

Tablesome stores contact-form submissions as tables and embeds tables into posts. The flaw (CVE-2026-14924) is that one of the endpoints the browser calls behind the scenes (an AJAX action) has no login check, no capability check, and no nonce — the one-time token that proves a request is genuine.

As a result someone who is not logged in can create new published posts and, worse, name an existing post or page and overwrite its contents. Replace the body of your About or Pricing page and every visitor arriving from search reads it as genuine. Because no administrator account was stolen, nothing in the login logs looks unusual. Severity is CVSS 7.5.

Versions below 1.1.31 are affected and 1.1.31 or later (currently 1.2.9) is safe. That fixed release has been out for a good while, so sites with auto-updates on are already covered. The exposed ones are those frozen on an old version — and as of today, exactly where to hit them is public information. The WPScan advisory has the detail.

CVE-2026-14490: Demi lets anyone delete entire folders from the server

Demi imports demo site layouts in one click and also handles backups and server migrations. The flaw (CVE-2026-14490) starts with the plugin storing a signing key that should have been secret inside a publicly readable folder.

During a restore, the plugin passes progress state back and forth and uses a signature to confirm the instruction came from a legitimate step. That signing key, however, sat as a dot-file inside the public uploads folder, with no access rules blocking it. Anyone who grabs the key can mint valid signatures themselves — and the restore endpoint is registered for unauthenticated callers. Finally, the folder to be deleted is taken from the caller with no allow-list and no path canonicalisation, so any directory on the server can be deleted recursively, contents and all. Severity is CVSS 7.5.

Versions 0.0.7 and below are affected. Release 0.0.8 added access-protection rules to the temporary folder, but reading the vendor's changelog, the substantive fix — moving secrets out of the web root, closing the unauthenticated entry points, and hardening path checks — landed in 0.0.9. Go to 0.0.9. The install base is small at 300+, but since what gets deleted is the site and its backups, the loss when it lands is the largest on this list.

What the other five actually are

These five require an account of some kind. Some carry high scores, but their practical reach is narrower than the three above. Feel free to read only the entry for the plugin you use.

CVE-2026-16585: Better Messages can have its config file deleted and the server taken over

Better Messages adds member-to-member chat and group conversations to a site. The flaw (CVE-2026-16585) is weak validation of which paths the sticker-deletion routine is allowed to touch.

The check was a simple prefix match: if the URL starts with the uploads folder, allow it. So a URL that begins legitimately but embeds ../ traversal sequences later in the path slips straight through, because the URL-cleaning function used does not strip those sequences — the payload is stored verbatim and then acted on. The destination that matters is wp-config.php, the file holding WordPress's database credentials. Delete it and WordPress falls back to its setup screen, where an attacker can attach their own database and take the site over. Severity is CVSS 7.2.

Exploitation requires administrator rights, so this is not something reachable from outside. Versions 2.15.19 and below are affected; 2.15.20 contains the fix, visible in the vendor's source changeset. The changelog does not mention the security fix, so do not dismiss the release as unrelated housekeeping. The report comes from Wordfence.

CVE-2026-14870: Database for Contact Form 7 turns one clicked link into a takeover

This plugin stores submissions from Contact Form 7, WPForms and Elementor forms inside the site, and runs on more than 60,000 installs. The flaw (CVE-2026-14870) is that an admin page reflected a parameter back into the output without escaping it — a reflected script-injection issue.

The attacker crafts an admin-area URL carrying a rigged value and gets an administrator to open it. The moment it loads, the attacker's code runs in that administrator's browser and with their rights — adding a new administrator account, for instance. The attacker needs no login of their own, but they do need to talk an admin into clicking, which makes it different in kind from the three that can be harvested automatically. Severity is CVSS 7.1. Versions below 1.5.3 are affected; for the reason explained below, go to 1.5.5.

CVE-2026-14926: FluentCart lets a customer meddle with someone else's subscription

FluentCart is a relatively new plugin that adds e-commerce to WordPress, subscriptions included. The flaw (CVE-2026-14926) is that several payment-method endpoints never verify that the subscription belongs to the person acting on it.

Anyone registered on the same site who knows another customer's subscription identifier can change that subscription's payment method, or cancel and re-bind it. Identifiers are often sequential, so working through them can pay off. It touches money directly, but exploitation requires a customer account and targets one victim at a time, which keeps severity at CVSS 4.2. Versions below 1.4.0 are affected; here too, 1.5.3 or later (currently 1.5.5) is the safer target.

CVE-2026-14819: Event Tickets lets an editor go after higher-privileged users

Event Tickets and Registration handles event sign-ups and ticket sales, and at 90,000+ installs it is the largest plugin in this batch. Its stablemate event calendar plugin had a separate data-exposure flaw published in July.

This flaw (CVE-2026-14819) is insufficient escaping of event titles when they are written into a ticket history log, so code planted in a title is stored and later executed. It requires Editor rights or above and only works on multisite installations. Despite the large install base, very few sites meet both conditions, and severity sits at a low CVSS 3.5. Versions below 5.28.4 are affected; the current release is 5.29.1.

CVE-2026-14821: Quiz and Survey Master lets a contributor delete your templates

Quiz and Survey Master is a long-standing plugin for building quizzes and surveys, with 40,000+ installs. The flaw (CVE-2026-14821) is a missing capability check on the routine that deletes output templates, so even a contributor-level user can delete them at will.

What is lost is presentation configuration — no member data leaks and no server is seized. Severity is CVSS 2.7, the lowest of the eight. If you hand contributor accounts to outside writers, moving to 11.1.5 or later (currently 11.2.2) is enough. The WPScan listing collects the plugin's earlier reports too.

For three of these, the listed fix is not the end of it

There is one trap when you sit down to update. For three of these plugins, moving to the version that fixes today's CVE still leaves a more recently disclosed flaw in place. That is why some "safe version" entries in the table above are ahead of the actual fix release.

FluentCart's later issue in particular exposes customers' personal details with no login at all, which is more likely to cause real harm than today's CVE-2026-14926 (customer account required, 4.2). If you run a store, do not stop at 1.4.0 — go to 1.5.3 or later.

This "I patched it but I am still not current" effect is common. Disclosure usually trails the fixed release by days or months, and by then the next version is out. So chasing the version numbers written in CVE records is slower and less reliable than simply moving to whatever the current release is. We made the same point about the Ninja Forms flaw that covered 600,000 sites: reading only the affected-version range is a good way to feel safe while staying exposed.

What to do right now

The steps are simple. Work through them from your admin area in this order.

Where to look during the inspection depends on the flaw. If you ran TrueBooker, check the Users list for administrators you do not recognise, and confirm your own password still works. If you ran Tablesome, check the body of static pages you rarely open — About, Pricing, Contact. Neither of those attacks requires stealing an administrator account, so login history alone will show nothing odd. If you ran Demi, check first that your backup destination has not been emptied.

None of the eight appear in CISA's catalogue of vulnerabilities confirmed to be under attack (KEV). So we are not yet at the "already being hunted" stage. But KEV only lists something once attacks have been observed, and by then you are reacting rather than preparing. Finishing the update now, right after disclosure, is the cheapest version of this problem you will get.

For everyday hygiene it comes down to deleting the plugins you do not use and enabling auto-updates on the ones you keep. We have made the "installed and forgotten is the real risk" point repeatedly in earlier WordPress plugin vulnerability roundups. If you also pull third-party components into a custom theme or bespoke code, running them through a dependency scanner will catch the gaps that sit outside the plugin list.

Summary

Of the eight published on July 28, 2026, the urgent ones are the three that need no login. TrueBooker lets an attacker rewrite the administrator's password (CVSS 9.8), Tablesome lets them overwrite live pages, and Demi lets them erase whole folders. The other five presuppose an administrator, editor, or customer account and are less pressing than their scores imply. The two with the biggest install bases — Event Tickets and Quiz and Survey Master — both turned out to be low-severity issues with narrow preconditions.

Fixed releases exist for all eight, and the work itself takes minutes from the admin screen. The one thing to watch is Database for Contact Form 7, FluentCart and Event Tickets, where today's fix version still leaves a newer flaw open. Rather than matching version numbers precisely, move to the current release. We will update this article if exploitation or a KEV listing is confirmed.

Sources

• ▸ NVD - CVE-2026-14545 (TrueBooker)
• ▸ NVD - CVE-2026-14924 (Tablesome Table)
• ▸ NVD - CVE-2026-14490 (Demi)
• ▸ NVD - CVE-2026-16585 (Better Messages)
• ▸ NVD - CVE-2026-14870 (Database for Contact Form 7)
• ▸ NVD - CVE-2026-14926 (FluentCart)
• ▸ NVD - CVE-2026-14819 (Event Tickets and Registration)
• ▸ NVD - CVE-2026-14821 (Quiz and Survey Master)
• ▸ WPScan - TrueBooker < 1.2.4 Unauthenticated Arbitrary Password Reset
• ▸ WPScan - Tablesome Table < 1.1.31 Unauthenticated Post Creation/Overwrite
• ▸ Wordfence Intelligence - Better Messages <= 2.15.19 Arbitrary File Deletion
• ▸ WordPress.org Plugin Trac - Better Messages fix diff (changeset 3623636)
• ▸ Patchstack - TrueBooker <= 1.1.9 Broken Access Control (CVE-2026-48881)
• ▸ WordPress.org - Demi plugin changelog
• ▸ Wordfence Intelligence - WordPress plugin vulnerability database