Read the docs
TI-2026-70266 Aliases CVE-2026-104898GHSA-688p-jfpg-cv62

Bookly WordPress plugin lets subscribers escalate privileges

Priority LOW 32CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

The Bookly plugin for WordPress is affected up to and including 28.4. Missing validation of a user-controlled key causes an insecure direct object reference (CWE-639). An authenticated subscriber linked to a Bookly staff record can overwrite the WordPress account binding of any staff record, including administrators, and escalate privileges. The link exists by default when the bookly_gen_allow_staff_edit_profile option is enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ladelaOnline Scheduling and Appointment Booking System – Booklyup to 28.4—No fix listedCNA
  • Online Scheduling and Appointment Booking System – Bookly Vendorladela Affected up to 28.4 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Bookly.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-104898
  2. 2026-10-10 Alias added: GHSA-688p-jfpg-cv62
  3. 2026-10-11 Priority changed: MEDIUM → LOW
  4. 2026-10-11 CISA SSVC decision points changed

References

Other 8

  • TI-2026-62969 Authorization bypass in ladela Online Scheduling and Appointment Booking System – Bookly CVSS 3.1CRITICAL 9.1
  • TI-2026-60359 Authorization bypass in ladela Online Scheduling and Appointment Booking System – Bookly CVSS 3.1HIGH 7.5
  • TI-2026-12256 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection CVSS 3.1HIGH 7.5
  • TI-2026-11363 Cross-site scripting in ladela Online Scheduling and Appointment Booking System – Bookly CVSS 3.1HIGH 7.2
  • TI-2026-04830 Cross-site scripting in ladela Online Scheduling and Appointment Booking System – Bookly CVSS 3.1HIGH 7.2
  • TI-2026-70141 PHP object injection in Bookly WordPress scheduling plugin CVSS 3.1HIGH 7.2
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences