TrueBooker CVE-2026-61951

The CVSS vector is AV:N/AC:L/PR:N/UI:N, so exploitation requires no authentication, no user interaction, and no special access - an unauthenticated remote attacker can reach the flaw against a site simply running the vulnerable plugin. The concrete prerequisite is that the target WordPress site has the TrueBooker (truebooker-appointment-booking) plugin installed and active at version 1.2.3 or earlier. The primary limiting factor is deployment: the site must actually run this specific plugin and version, so exploitation is constrained by the plugin's real-world install base rather than by any attacker-side barrier. The exact vulnerable endpoint/feature is not detailed in the provided data and should be confirmed against the Patchstack advisory.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) indicates the most severe combination: remotely reachable, low complexity, no privileges, no user interaction, with total confidentiality, integrity, and availability impact - consistent with full site takeover via privilege escalation. Countervailing signals lower the immediate urgency: no EPSS score was supplied, the CVE is not listed in CISA KEV, and no public proof-of-concept was referenced, so there is no evidence of active exploitation or a released exploit. This is therefore a genuinely high-severity, patch-promptly issue on technical merit, but current real-world exploitation pressure is unproven; SSVC-style inputs (automatable, exploitation status) were not provided in the data and cannot be asserted. Real-world priority should be scaled by how widely TrueBooker is actually deployed, which is likely modest for a niche booking plugin.

An attacker who identifies a WordPress site running TrueBooker <= 1.2.3 sends a crafted unauthenticated HTTP request to the plugin's vulnerable endpoint to assign themselves an elevated role or capability. Because no authentication, user interaction, or complex conditions are required (AV:N/AC:L/PR:N/UI:N), the attacker obtains a high-privilege account and can then install malicious plugins, exfiltrate data, or fully take over the site. No public proof-of-concept was identified at the time of analysis.