CVE-2026-12626

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.3

Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress allows PHP Object Injection through the deserialization of untrusted input. Authenticated attackers with custom-level access or higher can exploit this by manipulating the value parameter. PHP Object Injection occurs when an application deserializes untrusted data, potentially allowing an attacker to instantiate arbitrary objects and execute unintended code.

Recommendations Update the plugin to a version newer than 28.2. As a temporary mitigation, restrict access to the value parameter for users with custom-level permissions.