TrueBooker CVE-2026-73347

The only confirmed prerequisite is network access to a WordPress site running the TrueBooker (truebooker-appointment-booking) plugin at version 1.2.6 or earlier with the vulnerable component reachable. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special non-default configuration are required, and there is no privilege barrier limiting the attacker. The practical limiting factor is simply that the site must have this specific plugin installed and active at an affected version; the exact endpoint or feature that must be exposed is not detailed in the available data and should be confirmed against the Patchstack advisory.

All CVSS signals point to a high-priority issue: network attack vector, low complexity, no privileges, and no user interaction, with full CIA impact (9.8). However, several key signals are missing - no EPSS score, no KEV listing, no POC, and no SSVC decision data were provided. The absence of active-exploitation evidence means this is a high-severity-by-design flaw rather than a confirmed in-the-wild threat, so it should be prioritized on the strength of its trivial exploitability and the broad exposure of internet-facing WordPress sites, not on demonstrated attacker activity. The vector's PR:N (unauthenticated) is consistent with the description's 'Unauthenticated Privilege Escalation' label, so there is no conflict between the CVSS and the description here.

An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint on a public WordPress site running TrueBooker 1.2.6 or earlier and obtains elevated privileges - for example, creating or promoting an account to an administrative role. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction, making it suitable for automated, opportunistic scanning, though no public exploit code has been identified yet.