CVE-2026-2519
Price Manipulation in Bookly Plugin via Unvalidated Tips Parameter
Publication date: 2026-04-09
Last updated on: 2026-04-09
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bookly | bookly | From 27.1 (inc) |
| bookly | bookly | to 27.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-472 | The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable, such as hidden form fields. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-2519 is a vulnerability in the Bookly plugin for WordPress, specifically in its Online Scheduling and Appointment Booking System. The issue arises because the plugin trusts user-supplied input for the 'tips' parameter without validating it on the server side against the configured price.
This lack of validation allows unauthenticated attackers to submit a negative number as the 'tips' value, which can manipulate the total price calculation and reduce the total price to zero.
How can this vulnerability impact me? :
This vulnerability can allow attackers to manipulate the pricing of services or appointments booked through the Bookly plugin by submitting negative tip values.
As a result, attackers can reduce the total price to zero, potentially allowing them to obtain services without payment.
This can lead to financial loss for businesses using the plugin and undermine the integrity of the booking and payment system.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability CVE-2026-2519 in the Bookly plugin for WordPress is fixed in version 27.1.
To mitigate this vulnerability, you should immediately update the Bookly plugin to version 27.1 or later.
Updating ensures that the price manipulation issue via the 'tips' parameter is resolved and improves overall security and stability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-2519 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.