CVE-2026-93399
Received Received - Intake

Insecure Direct Object Reference in Bookly WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-93399
EUVD
EUVD-2026-86544

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bookly plugin to 28.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Bookly plugin for WordPress has an Insecure Direct Object Reference vulnerability in versions up to 28.2. It allows unauthenticated attackers to manipulate order IDs and access sensitive data like other customers' order tokens. The flaw occurs because the plugin stores attacker-controlled order IDs without proper verification, enabling enumeration of orders and unauthorized actions such as retrieving calendar information or deleting bookings.

Detection Guidance

Check for unauthorized access to order tokens or sequential order ID enumeration in Bookly plugin logs. Monitor for unusual AJAX requests to 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', or 'bookly_rollback_order' endpoints.

Impact Analysis

This vulnerability can lead to unauthorized access to other users' order details, exposure of sensitive appointment information, and deletion of non-completed bookings. Attackers could exploit it to retrieve calendar data or permanently remove bookings without permission, potentially disrupting services or leaking private information.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data (order tokens) and HIPAA by leaking protected health information if appointment details are involved. Unauthorized data access and deletion may result in non-compliance with privacy and security requirements, leading to legal and regulatory penalties.

Mitigation Strategies

Update the Bookly plugin to the latest version beyond 28.2. Disable unauthenticated access to the vulnerable AJAX actions if possible. Review and restrict permissions for order management functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93399. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart