CVE-2026-73347 Overview
CVE-2026-73347 is an unauthenticated privilege escalation vulnerability affecting the TrueBooker appointment booking plugin for WordPress in versions up to and including 1.2.6. The flaw is categorized under [CWE-266] (Incorrect Privilege Assignment) and allows a remote attacker to elevate privileges on affected WordPress sites without authentication. Because the plugin exposes privilege-affecting functionality to unauthenticated network requests, attackers can gain administrative access to targeted WordPress installations. Successful exploitation compromises the confidentiality, integrity, and availability of the site and its underlying data.
Critical Impact
An unauthenticated attacker can reach the network-exposed plugin endpoints and obtain elevated privileges, resulting in full compromise of the affected WordPress site.
Affected Products
- TrueBooker Appointment Booking WordPress plugin versions <= 1.2.6
- WordPress sites running the vulnerable plugin
- Any hosting environment exposing the plugin endpoints over the network
Discovery Timeline
- 2026-08-19 - CVE-2026-73347 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-73347
Vulnerability Analysis
CVE-2026-73347 is a privilege escalation flaw in the TrueBooker WordPress plugin. The plugin ships privileged operations that are reachable by unauthenticated users over the network. An attacker can invoke these operations to assign themselves elevated roles or otherwise gain administrative capabilities inside WordPress. Because no authentication and no user interaction are required, the attack can be executed at scale against any internet-facing site running the vulnerable plugin version. Once elevated, an attacker inherits the full capabilities of a WordPress administrator, including plugin and theme management, content modification, and code execution through plugin uploads.
The EPSS score for this vulnerability is 0.268% (percentile 19.111) as of 2026-08-20, indicating a modest but non-zero near-term probability of observed exploitation activity.
Root Cause
The root cause is incorrect privilege assignment [CWE-266] within the TrueBooker plugin. Privileged routes lack proper capability checks and nonce validation, so requests originating from unauthenticated sources are processed as if they carried administrative authorization. This flaw is described in the Patchstack Vulnerability Report.
Attack Vector
Exploitation occurs over the network against WordPress endpoints exposed by the plugin. An attacker crafts HTTP requests targeting the vulnerable plugin routes and manipulates role or capability parameters to elevate an account or create a new administrative user. Verified proof-of-concept code is not publicly available at the time of publication; refer to the Patchstack Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-73347
Indicators of Compromise
- Unexpected creation of new WordPress user accounts with administrator role
- Existing low-privileged accounts suddenly assigned elevated capabilities
- Unauthenticated POST requests to TrueBooker plugin endpoints under /wp-admin/admin-ajax.php or /wp-json/ routes
- Installation of unfamiliar plugins or themes following anomalous requests to the plugin
Detection Strategies
- Inventory WordPress installations and identify sites running the TrueBooker plugin at version 1.2.6 or earlier
- Review WordPress access logs for unauthenticated requests to TrueBooker plugin routes correlated with user role changes
- Enable WordPress audit logging plugins to record user_register, set_user_role, and promote_user events
Monitoring Recommendations
- Alert on privilege changes in the wp_users and wp_usermeta tables outside of maintenance windows
- Monitor web server logs for spikes in requests to plugin-specific endpoints originating from single IPs
- Ingest WordPress and web server logs into a centralized data lake to correlate authentication anomalies with plugin activity
How to Mitigate CVE-2026-73347
Immediate Actions Required
- Identify all WordPress sites running TrueBooker version 1.2.6 or earlier and prioritize remediation
- Update the TrueBooker plugin to a patched version once released by the vendor
- Audit all WordPress user accounts and remove any unauthorized administrator accounts
- Rotate credentials for all administrative WordPress users and invalidate active sessions
Patch Information
A fixed release addressing CVE-2026-73347 should be applied as soon as the vendor publishes an update beyond version 1.2.6. Consult the Patchstack Vulnerability Report for the current patch status and vendor advisory.
Workarounds
- Deactivate and remove the TrueBooker plugin until a patched version is available
- Restrict access to /wp-admin/admin-ajax.php and REST API endpoints exposed by the plugin using a web application firewall (WAF)
- Apply a virtual patch through a WordPress security plugin or WAF ruleset targeting unauthenticated requests to TrueBooker endpoints
- Limit outbound and inbound traffic on WordPress hosts to reduce the blast radius of a successful compromise
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
