CVE-2026-104898

Unauthenticated Broken Access Control vulnerability in Bookly up to version 28.2.

Insecure Direct Object References (IDOR) vulnerability in Bookly up to version 28.2. A Subscriber user can access unauthorized resources.

The Bookly plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the 'updateAddon' function in all versions up to and including 27.2. This allows authenticated attackers with Subscriber-level access and above to update any plugin with a main file of 'main.php' to its latest version.

The Bookly plugin up to version 27.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.

The Bookly plugin for WordPress (up to and including 28.2) is vulnerable to Insecure Direct Object Reference (IDOR) via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions. The 'bookly_get_form_id' handler stores an attacker-controlled 'order_id' into a new booking session, which 'bookly_render_complete' then trusts to return the order's secret token without verifying session ownership. This allows unauthenticated attackers to enumerate order IDs, disclose other customers' order tokens, retrieve calendar/appointment information, and permanently delete arbitrary non-completed bookings.

The Bookly plugin versions up to 27.7 are vulnerable to unauthenticated SQL injection.

The Bookly plugin for WordPress is vulnerable to PHP Object Injection through deserialization of untrusted input via the 'value' parameter in versions up to and including 28.2. Authenticated attackers with custom-level access or above can inject a PHP object, but no known gadget chain is available.

The Bookly plugin for WordPress up to version 28.4 is vulnerable to sensitive information exposure via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and getCodes() loads the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of customerIdentityConfirmed(). When placeholders like {client_name}, {client_email}, {client_phone}, or {client_note} are placed in the Details step's information text, the matched customer's stored data is substituted into the returned HTML.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress in all versions up to and including 28.1 is vulnerable to Insecure Direct Object Reference via the 'conversation_id' parameter due to missing validation on a user-controlled key. This allows unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details — and inject arbitrary messages into any victim conversation. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations by incrementing the conversation_id parameter.

The Bookly plugin for WordPress up to version 27.7 is vulnerable to Stored Cross-Site Scripting via the bookly_speed_up_update_addons AJAX action. Unauthenticated attackers can inject arbitrary scripts that execute when an administrator views the Diagnostics → Logs page.