CVE-2026-12905
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Bookly plugin for WordPress up to version 27.7 is vulnerable to Insecure Direct Object Reference in the appointment() method of the Mobile Staff Cabinet API. The handler loads an Appointment by the attacker-supplied id without verifying that the appointment's staff_id matches the authenticated staff member. Authenticated attackers with staff-level mobile cabinet access can read appointment details of other staff members, including internal notes and customer data, by enumerating sequential IDs.
Risk Assessment
The risk includes privacy breach of customers and staff, exposure of personal data and internal notes. However, the attack requires a valid staff access token, limiting access.
Recommendation
Update the plugin to a patched version. Also regularly review access logs and limit the number of valid tokens.
Original NVD description (English source)
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs.