CVE-2026-93399

Name of the Vulnerable Software and Affected Versions Bookly versions prior to 28.3

Description The Bookly plugin for WordPress contains an Insecure Direct Object Reference (IDOR) flaw. This occurs because the bookly get form id handler stores an attacker-controlled order id from the form data into a booking session without proper verification. Subsequently, the bookly render complete handler trusts this session to return the secret token of the corresponding order. This allows unauthenticated attackers to enumerate sequential order IDs and disclose secret tokens of other customers. Furthermore, attackers can retrieve calendar and appointment information through the bookly add to calendar AJAX action and permanently delete arbitrary non-completed bookings using the bookly rollback order AJAX action, which also deletes the associated customer appointment and the underlying appointment if no other customers are attached.

Recommendations Update Bookly to a version later than 28.2. As a temporary mitigation, restrict access to the bookly get form id, bookly render complete, bookly add to calendar, and bookly rollback order AJAX actions.