Theklis

**Name of the Vulnerable Software and Affected Versions** Bookly versions prior to 28.3 **Description** The Bookly plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs because the `bookly get form id` handler stores an attacker-controlled `order id` from the `form data` into a booking session without proper verification. Subsequently, the `bookly render complete` handler trusts this session to return the secret token of the corresponding order. This allows unauthenticated attackers to enumerate sequential order IDs and disclose secret tokens of other customers. Furthermore, attackers can retrieve calendar and appointment information through the `bookly add to calendar` AJAX action and permanently delete arbitrary non-completed bookings using the `bookly rollback order` AJAX action, which also deletes the associated `customer appointment` and the underlying appointment if no other customers are attached. **Recommendations** Update Bookly to a version later than 28.2. As a temporary mitigation, restrict access to the `bookly get form id`, `bookly render complete`, `bookly add to calendar`, and `bookly rollback order` AJAX actions.