CVE-2026-12905
Received Received - Intake

Insecure Direct Object Reference in Bookly WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-12905
EUVD
EUVD-2026-59850

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly plugin to 27.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Bookly WordPress plugin has an Insecure Direct Object Reference (IDOR) vulnerability in versions up to 27.7. It allows authenticated staff members with mobile cabinet access to read appointment details of other staff members by manipulating the appointment ID parameter. The vulnerability exists because the appointment() method does not verify if the requested appointment belongs to the authenticated staff member, unlike other operations that correctly scope appointments to the staff's ID.

This flaw enables attackers to enumerate sequential appointment IDs and access sensitive data such as internal notes, customer names, emails, phone numbers, payment details, and custom fields.

Detection Guidance

To detect this vulnerability, check WordPress sites using the Bookly plugin version 27.7 or lower. Look for unauthorized access to appointment details via the Mobile Staff Cabinet API. Review logs for sequential appointment ID enumeration attempts by staff accounts.

Impact Analysis

If you are a WordPress site administrator using the Bookly plugin, an attacker with staff-level access could exploit this to steal sensitive customer data, including personal information and payment details. This could lead to privacy breaches, financial fraud, or reputational damage for your business.

Even if you are not directly affected, customers whose data is exposed may face identity theft or phishing attacks, harming trust in your services.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting personal and health data. GDPR mandates strict controls for personal data access and breach notification, while HIPAA requires safeguards for protected health information. Exploiting this flaw could result in unauthorized data exposure, leading to regulatory fines and legal consequences.

Mitigation Strategies

Update the Bookly plugin to the latest version beyond 27.7 to address the insecure direct object reference vulnerability. Ensure staff-level access is properly scoped to prevent unauthorized data exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-12905. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart