CVE-2026-103365
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.
Risk Assessment
The organization is at risk of unauthorized access to customer personal data, which may violate data protection regulations and lead to loss of trust.
Recommendation
Update the Bookly plugin to the latest version with a fix. Also consider removing sensitive placeholders from forms and strengthening authentication mechanisms.
Other vulnerabilities in Bookly
See all- CVE-2026-96348High
Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.
- CVE-2026-96347Medium
Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.
- CVE-2026-2520Medium
The Bookly plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'updateAddon' function in all versions up to and including 27.2. This allows authenticated attackers with Subscriber-level access and above to update any plugin with a main file of 'main.php' to its latest version.
- CVE-2026-61944High
The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.
- CVE-2026-93399Critical
The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.
- CVE-2026-61949Critical
The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.
- CVE-2026-12626High
The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.
- CVE-2026-104898Medium
The Bookly plugin for WordPress up to version 28.4 is vulnerable to Insecure Direct Object Reference via the 'id, wp_user_id' parameter due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.
- CVE-2026-89063High
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.
- CVE-2026-13424High
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.
Original NVD description (English source)
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS