EUVD-2026-48209
GHSA-jwj9-c7w4-qmpm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated privilege escalation reachable over the network with no user interaction (PR:N/UI:N/AV:N/AC:L); resulting admin control yields full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
AnalysisAI
Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unauthenticated remote attackers gain elevated privileges via an incorrect privilege-assignment flaw (CWE-266). With a CVSS 9.8 network/no-auth vector, a successful attacker can escalate to a high-privilege account and fully compromise the affected WordPress site; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector is AV:N/AC:L/PR:N/UI:N, so exploitation requires no authentication, no user interaction, and no special access - an unauthenticated remote attacker can reach the flaw against a site simply running the vulnerable plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) indicates the most severe combination: remotely reachable, low complexity, no privileges, no user interaction, with total confidentiality, integrity, and availability impact - consistent with full site takeover via privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who identifies a WordPress site running TrueBooker <= 1.2.3 sends a crafted unauthenticated HTTP request to the plugin's vulnerable endpoint to assign themselves an elevated role or capability. Because no authentication, user interaction, or complex conditions are required (AV:N/AC:L/PR:N/UI:N), the attacker obtains a high-privilege account and can then install malicious plugins, exfiltrate data, or fully take over the site. … |
| Remediation | Upgrade the TrueBooker plugin to a version later than 1.2.3 as soon as the vendor publishes a fixed release; the input data does not include an exact patched version number, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-3-privilege-escalation-vulnerability) and the ThemeTechMount vendor page for the fixed build before deploying - do not assume a version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: immediately disable and remove the TrueBooker plugin from all WordPress installations running version 1.2.3 or earlier, and catalog which sites were affected. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Truebooker
View allAccount takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL
Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una
Same weakness CWE-266 – Incorrect Privilege Assignment
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today