PT-2026-95762 · WordPress · Online Scheduling/Appointment Booking System – Bookly
CVSS v3.1
4.8
Medium
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.2
Description
The plugin fails to verify if the requester is the owner of the AI booking-assistant conversation during unauthenticated conversation actions. This allows an unauthenticated visitor to read messages from other visitors' assistant conversations and inject messages into active conversations.
Recommendations
Update the Online Scheduling and Appointment Booking System WordPress plugin to version 28.2 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Online Scheduling/Appointment Booking System – Bookly