Skip to main content

TrueBooker EUVDEUVD-2026-62381

| CVE-2026-73347 CRITICAL
Incorrect Privilege Assignment (CWE-266)
2026-08-19 Patchstack GHSA-rj26-wv7g-62x2
Privilege Escalation Truebooker
9.8
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
9.8 CRITICAL

Unauthenticated network-reachable privilege escalation with no user interaction gives AV:N/AC:L/PR:N/UI:N, and gaining admin-level rights yields full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 19, 2026 - 13:25 vuln.today
CVE Published
Aug 19, 2026 - 12:38 cve.org
CRITICAL 9.8

DescriptionCVE.org

Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.

AnalysisAI

Unauthenticated privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin versions 1.2.6 and earlier allows a remote attacker with no credentials to elevate their privileges within the WordPress site, per a Patchstack report. The CVSS 9.8 rating (AV:N/AC:L/PR:N/UI:N) reflects fully remote, low-complexity abuse with high confidentiality, integrity, and availability impact. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site running TrueBooker ≤1.2.6
Delivery
Send crafted unauthenticated request to plugin endpoint
Exploit
Trigger incorrect privilege assignment
Execution
Gain elevated/admin privileges
Impact
Take over site
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The only confirmed prerequisite is network access to a WordPress site running the TrueBooker (truebooker-appointment-booking) plugin at version 1.2.6 or earlier with the vulnerable component reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment All CVSS signals point to a high-priority issue: network attack vector, low complexity, no privileges, and no user interaction, with full CIA impact (9.8). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint on a public WordPress site running TrueBooker 1.2.6 or earlier and obtains elevated privileges - for example, creating or promoting an account to an administrative role. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no user interaction, making it suitable for automated, opportunistic scanning, though no public exploit code has been identified yet.
Remediation No specific vendor-released fix version was provided in the available data, so no patched version can be cited with confidence; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/truebooker-appointment-booking/vulnerability/wordpress-truebooker-plugin-1-2-6-privilege-escalation-vulnerability) and the WordPress plugin repository for the earliest release above 1.2.6 and upgrade to it once confirmed. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, conduct an inventory of all WordPress installations to identify TrueBooker plugin versions 1.2.6 and earlier and immediately disable the plugin if not actively used in critical workflows. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Truebooker

View all
CVE-2026-14545 CRITICAL POC
9.8 Jul 28

Account takeover in TrueBooker WordPress plugin before 1.2.4 enables unauthenticated attackers to reset any user’s passw
CVE-2024-6924 CRITICAL POC
9.8 Sep 08

The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL

CVE-2026-61951 CRITICAL
9.8 Jul 23

Privilege escalation in the TrueBooker (truebooker-appointment-booking) WordPress plugin through version 1.2.3 lets unau
CVE-2026-61950 CRITICAL
9.3 Jul 23

Unauthenticated SQL injection in the TrueBooker (truebooker-appointment-booking) WordPress plugin by themetechmount affe
CVE-2026-48881 CRITICAL
9.1 Jun 15

Unauthenticated broken access control in the TrueBooker WordPress appointment-booking plugin (versions ≤ 1.1.9 by ThemeT
CVE-2024-6925 MEDIUM POC
4.3 Sep 08

The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could a
CVE-2026-39663 MEDIUM
5.3 Apr 08

TrueBooker appointment booking plugin through version 1.1.5 fails to enforce proper authorization controls, allowing una

Same weakness CWE-266 – Incorrect Privilege Assignment

View all
CVE-2025-27007 CRITICAL POC
9.8
CVE-2024-28000 CRITICAL POC
9.8
CVE-2026-48172 CRITICAL POC
10.0
CVE-2024-24882 CRITICAL POC
9.8
CVE-2025-47539 CRITICAL POC
9.8
CVE-2022-20759 HIGH POC
8.8
CVE-2024-54363 CRITICAL
9.8
CVE-2026-23550 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Share

EUVD-2026-62381 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy