PT-2026-99495 · WordPress · Online Scheduling/Appointment Booking System – Bookly
CVE-2026-86839
·
Published
2026-09-27
·
Updated
2026-09-28
CVSS v3.1
3.8
Low
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.3
Description
Authenticated attackers with a staff-level account can view, modify, and delete appointment and payment records belonging to other staff members, including associated customer personal information. This occurs because the plugin fails to verify ownership of the records requested through staff-role AJAX actions.
Recommendations
Update the Online Scheduling and Appointment Booking System WordPress plugin to version 28.3 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Online Scheduling/Appointment Booking System – Bookly