EUVD-2026-20890
GHSA-ghp2-h9w4-7r66
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Server-side parameter enforcement
|
| Impact | While the CVSS score of 5.3 is moderate, the real-world risk is materially higher than the base score suggests. The vulnerability requires no authentication (PR:N) and no user interaction (UI:N) beyond submitting a booking request, with network-accessible attack surface (AV:N). The integrity impact (I:L) captures financial loss through price reduction to zero. From an SSVC perspective, this represents high technical impact (unavailability or loss of enterprise function) with high exploitability-a business logic flaw is typically easier to weaponize than memory corruption. The lack of confirmed active exploitation or public POC does not reduce real-world risk because: (1) the exploitation method is trivial (submit negative number), (2) WordPress plugins are frequently scanned for known CVEs, and (3) financial incentive is immediate and direct. Organizations should prioritize this above higher-CVSS vulnerabilities with lower exploitability. The attack complexity is low, making automation practical for widespread scanning across multiple Bookly installations. |
| Exploit ScenarioDerived | An attacker discovers a website using Bookly for appointment bookings and identifies a service with a $100 booking fee. During checkout, the attacker intercepts or directly submits the booking request with a 'tips' parameter set to -100, causing the total price to become $0. The attacker completes the booking without payment, and the service provider loses the revenue. Since no authentication is required and the attack requires only a single HTTP request with modified parameter values, an attacker could automate this across multiple Bookly installations or perform it manually on any public appointment booking site. No public exploit code is required given the straightforward nature of parameter manipulation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Price manipulation in Bookly WordPress plugin (versions up to 27.0) allows unauthenticated attackers to reduce appointment booking costs to zero by submitting negative values to the 'tips' parameter, exploiting insufficient server-side validation of user-supplied pricing input. No public exploit code or active exploitation has been confirmed, but the vulnerability carries moderate risk due to its ease of exploitation and direct financial impact on e-commerce transactions.
RemediationAI
Update the Bookly plugin immediately to a version after 27.0 where server-side validation of the 'tips' parameter has been implemented. The vendor has released a fix as referenced in the official changelog at https://www.booking-wp-plugin.com/change-log/ and changeset 3480956. Administrators should verify the update through WordPress admin panel (Plugins > Installed Plugins > Bookly) and confirm the new version is running. As a temporary workaround pending update, disable the tips/gratuity feature in Bookly settings if business requirements permit, or implement Web Application Firewall (WAF) rules to reject booking requests with negative tip values. Server-side validation fixes should ensure all pricing fields are recalculated server-side from the configured appointment rates, never trusting client-supplied values for financial calculations.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bookly is a WordPress plugin for online appointment scheduling and payment processing. The vulnerability exists in the plugin's handling of the 'tips' parameter, which is processed without proper server-side validation in multiple locations (UserBookingData.php line 355, Ajax.php line 709, and CartInfo.php line 450). The root cause is classified as CWE-472 (Insufficient Input Validation), where the plugin trusts client-supplied pricing data without verifying it against the configured appointment price on the server. This is a classic business logic vulnerability in e-commerce systems where cost calculations should never rely solely on client-side inputs or user-provided values without backend verification. The affected product is the Online Scheduling and Appointment Booking System - Bookly plugin distributed through the WordPress plugin repository.
Know when Online Scheduling And Appointment Booking System Bookly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The Online Scheduling and Appointment Booking System - Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including na
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for W
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enabl
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all ve
Stored cross-site scripting in the Bookly Online Scheduling and Appointment Booking System plugin for WordPress (version
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers w
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows an
Unauthenticated attackers who already know a registered customer's primary phone number or email can read that customer'
Unauthenticated attackers can overwrite the name, email, phone, and address of any existing customer record in the Bookl
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) all
Exploit-DB