Bookly CVE-2026-104898

Requires an authenticated WordPress account with subscriber-level access or above (PR:L), and the attacking user must be linked to at least one Bookly staff record. That linkage occurs by default when an admin enables the bookly_gen_allow_staff_edit_profile option, which is active on fresh Bookly installs. Exploitation targets the staff-edit AJAX endpoint via the user-controlled 'id'/'wp_user_id' parameters. Limiting factors: the site must run Bookly ≤28.4, the attacker must obtain a subscriber account (so sites disabling open registration raise the bar), and the staff-edit-profile option/staff-record linkage must be present - environments that disabled this option or never linked WP users to staff entries are not exposed. No user interaction is required (UI:N).

This is a genuine but conditionally-gated privilege-escalation issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.8 Medium) tells a coherent story: network-reachable, but with high attack complexity and low-privilege (subscriber) authentication required, yielding high confidentiality and integrity impact via account hijacking. The AC:H rating is well-justified because exploitation is not universal - the attacker must already be linked to at least one Bookly staff record, which only holds when the bookly_gen_allow_staff_edit_profile option is enabled (notably, this is active on fresh installs). No EPSS score, KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (no CVSS-vs-description conflict): a network IDOR on a user-controlled key requiring a logged-in account. The practical priority is moderate - the impact (seizing an administrator's staff-account binding to escalate privileges) is serious, but the subscriber-account requirement plus the staff-record-linkage precondition meaningfully narrow the realistic attacker population compared to an unauthenticated flaw. Prioritize patching on sites that allow open user registration and run default Bookly staff-profile settings.

On a WordPress site running Bookly (≤28.4) that permits self-registration and has the default staff-edit-profile option enabled, an attacker registers a subscriber account that becomes linked to a Bookly staff record. They then send a crafted AJAX request manipulating the 'id'/'wp_user_id' parameters to overwrite an administrator's Bookly staff record so it points at the attacker's WordPress user, hijacking the higher-privileged account association and escalating privileges. No public exploit code was identified in the provided data, and AC:H reflects the required staff-record linkage precondition.