CVE-2026-86837
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details. This allows unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
Risk Assessment
An attacker can alter customers' personal data, leading to a breach of data confidentiality and integrity, and potentially enabling fraud or phishing. The organization may face liability for a personal data breach.
Recommendation
Update the Bookly plugin to version 28.3 or later. Verify that updating customer details requires proper identity verification.
Other vulnerabilities in Bookly WordPress plugin
See all- CVE-2026-86838Medium
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
- CVE-2026-92799Medium
The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.
Original NVD description (English source)
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS