Unauthenticated Privilege Escalation in TrueBooker Booking Plugin by Patchstack
CVE-2026-73347

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Truebooker
Vendor
CVE Published:
19 August 2026

What is CVE-2026-73347?

The TrueBooker plugin versions up to 1.2.6 have a vulnerability that allows unauthenticated users to escalate their privileges, potentially leading to unauthorized access to sensitive information and functions. This flaw can be exploited without needing valid user credentials, emphasizing the importance of updating to a secure version to protect against unauthorized actions.

Affected Version(s)

TrueBooker <= 1.2.6

References

https://patchstack.com/database/wordpress/plugin/truebook...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdullah Kareem "cyberkareem" | Patchstack Bug Bounty Program
.