CVE-2026-86838
MediumCVSS 5.3Summary
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total. This allows unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Risk Assessment
An unauthenticated attacker can book paid services at no cost, leading to financial losses and abuse. The vulnerability requires no authentication and can be easily exploited at scale.
Recommendation
Update the Bookly plugin to version 28.3 or later. Implement additional server-side validation of booking quantities.
Other vulnerabilities in Bookly WordPress plugin
See all- CVE-2026-86837Medium
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details. This allows unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
- CVE-2026-92799Medium
The Bookly plugin for WordPress (versions up to and including 28.2) is vulnerable to Authorization Bypass via PHP Type Juggling. Due to the use of a loose inequality operator in the verification function and lack of CSRF and authentication protection in the AJAX controller, an unauthenticated attacker can bypass phone/email ownership verification and overwrite any Bookly customer's data.
Original NVD description (English source)
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS