What is the CVSS score of EUVD-2026-48209?

EUVD-2026-48209 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of TrueBooker are affected by EUVD-2026-48209?

The TrueBooker WordPress plugin (versions 1.2.3 and earlier) contains a critical privilege escalation vulnerability allowing unauthenticated attackers to seize full administrative control of affected…

How to fix or mitigate EUVD-2026-48209?

Within 24 hours: immediately disable and remove the TrueBooker plugin from all WordPress installations running version 1.2.3 or earlier, and catalog which sites were affected. Within 7 days: contact the TrueBooker vendor to confirm patch availability and timeline, deploy Web Application Firewall rules to block requests targeting the plugin's vulnerable endpoints, and restrict WordPress administrative access by IP whitelist. Within 30 days: apply the vendor patch upon release, or migrate appointment booking functionality to an alternative plugin with current security patches and vendor support.

TrueBooker EUVD-2026-48209

| CVE-2026-61951 CRITICAL

Incorrect Privilege Assignment (CWE-266)

2026-07-23 Patchstack

GHSA-jwj9-c7w4-qmpm

WordPress Privilege Escalation Truebooker Wordpress Plugin Themetechmount

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated privilege escalation reachable over the network with no user interaction (PR:N/UI:N/AV:N/AC:L); resulting admin control yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:39 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.

AnalysisAI

Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.

Technical ContextAI

TrueBooker is an appointment-booking plugin published by ThemeTechMount for the WordPress CMS (CPE cpe:2.3:a:themetechmount:truebooker:*). The root cause is CWE-266 (Incorrect Privilege Assignment), meaning the plugin assigns a privilege level to a user or request that is higher than intended - typically because a registration, role-setting, or capability-granting endpoint fails to properly restrict or validate who may invoke it or what role is applied. In the WordPress model this class of bug commonly manifests as an AJAX or REST handler that lets an anonymous request set or alter a user's role/capabilities (e.g., promoting an account to administrator) without an authorization or nonce check.

RemediationAI

Upgrade the TrueBooker plugin to a version later than 1.2.3 as soon as the vendor publishes a fixed release; the input data does not include an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-3-privilege-escalation-vulnerability) and the ThemeTechMount vendor page for the fixed build before deploying - do not assume a version. Until a patched version is confirmed and applied, the safest compensating control is to deactivate and remove the TrueBooker plugin, which stops the vulnerable code path at the cost of losing appointment-booking functionality. If removal is not acceptable, place a Web Application Firewall (Patchstack's virtual patch or a WAF rule) in front of the site to block requests to the plugin's registration/role-assignment endpoints, and audit existing WordPress accounts for unexpected administrator or elevated-role users created before remediation, resetting credentials as needed; WAF rules may need tuning to avoid breaking legitimate booking requests.