CVE-2026-92799
Received Received - Intake

Authorization Bypass via PHP Type Juggling in Bookly WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the `json_data` input channel decodes input via `json_decode()`, which preserves real PHP types and causes the `wp_kses` filter to leave non-string values such as the JSON boolean `true` untouched; submitting `true` as the `verification_code` satisfies the loose comparison against the session's non-zero integer code (generated by `mt_rand(100000, 999999)`), causing `true != <non-zero int>` to evaluate as `false` and the guard to be bypassed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92799
EUVD
EUVD-2026-86543

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly bookly to 28.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Authorization Bypass in the Bookly WordPress plugin due to PHP Type Juggling. The postValidateCustomer() function uses a loose inequality operator (!=) to compare a session-stored verification code with user input. The booking AJAX controller is exposed via wp_ajax_nopriv_ handlers, making it unauthenticated and CSRF-unprotected. Attackers can exploit this by submitting true as the verification_code, bypassing the verification step and modifying customer details like name, email, phone, and address.

The flaw occurs because json_decode() preserves PHP types, allowing true to satisfy the loose comparison against a non-zero integer session code. This redirects booking notifications to attacker-controlled contact details.

Impact Analysis

Unauthenticated attackers can overwrite customer data in the Bookly plugin, including contact details. This could lead to stolen booking notifications, phishing attempts, or unauthorized changes to customer records. The impact is limited to data modification but does not directly expose sensitive data or cause system compromise.

Compliance Impact

This vulnerability could violate GDPR by enabling unauthorized modification of personal data (name, email, phone) without consent. For HIPAA, it may compromise protected health information integrity if customer records include such data. Organizations using Bookly must address this to maintain compliance with data integrity and protection requirements.

Mitigation Strategies

Update the Bookly plugin to the latest version beyond 28.2 immediately. Disable unauthenticated AJAX endpoints if possible and review customer data for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart