CVE-2026-93399
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.
Risk Assessment
Attackers can access other customers' data (order tokens, appointment details) and permanently delete bookings, leading to data leakage and disruption of the booking service.
Recommendation
Update the Bookly plugin to a version newer than 28.2; if not possible, disable the vulnerable AJAX actions or restrict access to them. Additionally, implement server-side authorization checks for order operations.
Other vulnerabilities in Bookly
See all- CVE-2026-96348High
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
- CVE-2026-96347Medium
Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.
- CVE-2026-2520Medium
The Bookly plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'updateAddon' function in all versions up to and including 27.2. This allows authenticated attackers with Subscriber-level access and above to update any plugin with a main file of 'main.php' to its latest version.
- CVE-2026-61944High
The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-61949Critical
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
- CVE-2026-12626High
The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.
- CVE-2026-104898Medium
The Bookly plugin for WordPress up to version 28.4 is vulnerable to Insecure Direct Object Reference via the 'id, wp_user_id' parameter due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.
- CVE-2026-103365Medium
The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.
- CVE-2026-89063High
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.
- CVE-2026-13424High
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.
Original NVD description (English source)
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS