TrueBooker CVE-2026-61950

The concrete prerequisite is a WordPress site with the TrueBooker (truebooker-appointment-booking) plugin, version 1.2.3 or earlier, installed and active - the vulnerable booking endpoint must be reachable. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so there are no special conditions beyond that: remote, unauthenticated exploitation is possible against default configurations, with no authentication, no user interaction, and no non-default settings required. The primary factors limiting exploitation are the need for the specific plugin to be present and active and the plugin's relatively narrow real-world deployment; there is no known POC yet, which slightly raises the effort of finding the exact injectable parameter.

The Patchstack-assigned CVSS is 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L): network-reachable, low complexity, no privileges and no user interaction, meaning the technical barrier to exploitation is minimal. However, corroborating exploitation signals are absent - no EPSS score was provided, the CVE is not in CISA KEV, and no POC/exploit code is referenced, so there is no evidence of active or widespread exploitation yet. The realistic prioritization is driven by the trivially automatable, unauthenticated nature of the flaw combined with mass-scanning behavior typical of WordPress plugin SQLi, tempered by the plugin's likely modest deployment footprint. Note a discrepancy worth verifying: the vector sets I:N and only A:L despite this being SQL injection, which usually permits data modification - the assigner likely scoped the reachable query as read/limited, but defenders should not assume write access is impossible without confirmation.

An attacker discovers a WordPress site running TrueBooker (via plugin fingerprinting) and sends a crafted request to the vulnerable booking endpoint containing SQL metacharacters in an unsanitized parameter. Requiring no authentication or user interaction, they use boolean/time-based or UNION techniques to dump the wp_users table and password hashes, then crack or reuse them to escalate access. No public POC is referenced yet, but the AV:N/AC:L profile makes such an exploit straightforward to script once the parameter is identified.