What is the CVSS score of EUVD-2026-48208?

EUVD-2026-48208 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of TrueBooker are affected by EUVD-2026-48208?

The TrueBooker WordPress plugin (versions 1.2.3 and earlier) contains a critical vulnerability allowing unauthenticated remote attackers to access the WordPress database directly.

How to fix or mitigate EUVD-2026-48208?

Within 24 hours: disable the TrueBooker plugin on all WordPress installations running version 1.2.3 or earlier; audit all sites for plugin presence and document the exposure window. Within 7 days: implement Web Application Firewall rules blocking SQL injection patterns to the plugin parameters if disabling is operationally unfeasible; review database logs for signs of unauthorized access and rotate WordPress admin and database credentials on affected systems. Within 30 days: monitor themetechmount vendor advisories for patch availability; upon release, test in staging and deploy the patch across all affected WordPress installations.

TrueBooker EUVD-2026-48208

| CVE-2026-61950 CRITICAL

SQL Injection (CWE-89)

2026-07-23 Patchstack

GHSA-qh8q-259v-qvrj

WordPress SQLi Truebooker Wordpress Plugin Themetechmount

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

8.2 HIGH

Unauthenticated remote SQLi gives high confidentiality (full DB read) and limited integrity via injectable writes; scope kept Unchanged as impact stays within the site database.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:40 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.

AnalysisAI

Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affects all versions up to and including 1.2.3, letting remote attackers inject arbitrary SQL through an exposed plugin parameter without any authentication. Rated CVSS 9.3, it enables extraction of sensitive WordPress database contents (user records, credentials, secrets) and, per the scope-changed CVSS vector, impact reaching beyond the plugin's own security boundary. No public exploit identified at time of analysis and it is not on CISA KEV, but the unauthenticated network vector makes it an attractive automation target.

Technical ContextAI

TrueBooker is an appointment-booking plugin for WordPress (CPE cpe:2.3:a:themetechmount:truebooker) that stores and queries booking data in the shared WordPress MySQL/MariaDB database. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaches a database query without parameterization or proper sanitization, most likely bypassing WordPress's $wpdb->prepare()/sanitization helpers on a public-facing AJAX or REST endpoint. Because the plugin shares the site's single database, an injection point in a booking handler can be leveraged to read tables well outside the plugin's own data, which is reflected in the scope-changed (S:C) CVSS assessment.

RemediationAI

No vendor-released patch version is identified in the available data, so treat 1.2.3 and earlier as unpatched and upgrade to any later fixed release listed on the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-3-sql-injection-vulnerability?_s_id=cve) as soon as themetechmount publishes one. Until a fixed version is confirmed, the most effective compensating control is to deploy a WAF virtual patch (Patchstack, Wordfence, or ModSecurity CRS) with SQLi rules covering the plugin's endpoints, accepting possible false positives on booking submissions; alternatively deactivate and remove the TrueBooker plugin entirely, which stops the attack surface at the cost of disabling appointment booking on the site. As a supporting measure, restrict the WordPress database account privileges to the minimum needed and monitor for anomalous queries against wp_users/wp_options, understanding this limits data theft impact but does not close the injection itself.