CVE case study
CVE-2026-73347: Unauthenticated Privilege Escalation in the TrueBooker Booking Plugin
The TrueBooker appointment-booking plugin through 1.2.6 assigned privileges incorrectly, letting an unauthenticated request gain higher access. Version 1.2.7 corrects the privilege assignment.
- Weakness
- CWE-266
- Affected
- TrueBooker 1.2.6 and earlier
- Remediation state
- Upgrade to TrueBooker 1.2.7 or later
- Advisory published
- 19 Aug 2026
Official vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Why it matters
TrueBooker is a WordPress appointment-booking plugin. In versions through 1.2.6, an incorrect privilege assignment let an unauthenticated request obtain a higher privilege level than it should hold.
The public record scores the issue Critical at 9.8 because it needs no account and can lead to full control of an affected site. Version 1.2.7 corrects the privilege check.