CVE-2026-86838
Received Received - Intake

Unauthenticated Price Manipulation in Bookly WordPress Plugin

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: WPScan

Description
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-86838
EUVD
EUVD-2026-88099

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly plugin to 28.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Bookly WordPress plugin before version 28.3. It allows unauthenticated users to submit invalid booking quantity values that the server does not validate before calculating the total cost. This can reduce the total price to zero, letting users book paid services without paying.

Detection Guidance

To detect this vulnerability, check if your Bookly plugin version is below 28.3. You can do this by logging into your WordPress admin panel, navigating to the Plugins section, and looking for the Bookly plugin version. If it is outdated, update it immediately.

Impact Analysis

If you use the Bookly plugin before version 28.3, attackers could exploit this to book your paid services for free by manipulating the booking price. This could lead to financial losses for your business.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling unauthorized access to paid services without payment, which may violate data protection and privacy requirements depending on how the service handles user data and transactions.

Mitigation Strategies

Immediately update the Bookly plugin to version 28.3 or later. If updating is not possible, consider disabling the plugin temporarily until an update can be applied. Monitor your website for unauthorized bookings or unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86838. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart