EUVD-2026-59850
GHSA-j9h8-cf5v-78mc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
PR:L confirmed because exploitation requires a valid bound staff access_key token; C:L reflects partial PII disclosure scoped to appointment records without full system compromise.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details - including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) - belonging to other staff members by enumerating sequential appointment IDs.
AnalysisAI
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
Technical ContextAI
Bookly - Responsive Appointment Booking Tool is a WordPress scheduling plugin by Ladela (CPE: cpe:2.3:a:ladela:online_scheduling_and_appointment_booking_system_-_bookly:*:*:*:*:*:*:*:*). The vulnerability is located in the Mobile Staff Cabinet API handler at frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php, specifically in the appointment() method triggered by the resource=appointment, action=bookly_mobile_staff_cabinet API call. CWE-639 (Authorization Through User-Controlled Key) precisely describes the root cause: the method fetches an Appointment record using caller-supplied params[id] without cross-referencing the appointment's staff_id against the authenticated requestor's staff identity. The fix pattern is already present in the codebase - methods deleteAppointment, saveAppointment, and the appointments list all correctly gate on $this->staff->getId() when $this->role === ROLE_STAFF - making this a localized authorization omission in the read path. Appointment IDs appear to be sequential integers, making enumeration trivial once access is obtained.
RemediationAI
Update the Bookly plugin to a version incorporating changeset 3637918 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool); an exact released patch version number was not independently confirmed in the available data - administrators should verify via the WordPress.org plugin page that the installed version is newer than 27.7. As an interim compensating control, administrators can disable the Mobile Staff Cabinet feature entirely, which eliminates the vulnerable API surface; note this will prevent staff from using the mobile scheduling interface. Alternatively, restricting staff-level accounts to only fully trusted personnel reduces exposure, but does not eliminate the risk if any staff credential is compromised. Wordfence's threat intelligence entry provides additional context at https://www.wordfence.com/threat-intel/vulnerabilities/id/1600466e-ad45-4dc7-916b-6c97301d2b03.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today