What is the CVSS score of CVE-2026-2519?

CVE-2026-2519 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2519?

Yes, a patch is available for CVE-2026-2519. Update the affected software to the latest version immediately.

WordPress CVE-2026-2519

EUVD-2026-20890 MEDIUM

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-04-09 Wordfence

GHSA-ghp2-h9w4-7r66

GHSA-rf8c-3f5p-xv45

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 09, 2026 - 20:30 nvd

Patch available

EUVD ID Assigned

Apr 09, 2026 - 13:00 euvd

EUVD-2026-20890

Analysis Generated

Apr 09, 2026 - 13:00 vuln.today

CVE Published

Apr 09, 2026 - 12:28 nvd

MEDIUM 5.3

DescriptionCVE.org

The Online Scheduling and Appointment Booking System - Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.

AnalysisAI

Price manipulation in Bookly WordPress plugin (versions up to 27.0) allows unauthenticated attackers to reduce appointment booking costs to zero by submitting negative values to the 'tips' parameter, exploiting insufficient server-side validation of user-supplied pricing input. No public exploit code or active exploitation has been confirmed, but the vulnerability carries moderate risk due to its ease of exploitation and direct financial impact on e-commerce transactions.

Technical ContextAI

Bookly is a WordPress plugin for online appointment scheduling and payment processing. The vulnerability exists in the plugin's handling of the 'tips' parameter, which is processed without proper server-side validation in multiple locations (UserBookingData.php line 355, Ajax.php line 709, and CartInfo.php line 450). The root cause is classified as CWE-472 (Insufficient Input Validation), where the plugin trusts client-supplied pricing data without verifying it against the configured appointment price on the server. This is a classic business logic vulnerability in e-commerce systems where cost calculations should never rely solely on client-side inputs or user-provided values without backend verification. The affected product is the Online Scheduling and Appointment Booking System - Bookly plugin distributed through the WordPress plugin repository.

RemediationAI

Update the Bookly plugin immediately to a version after 27.0 where server-side validation of the 'tips' parameter has been implemented. The vendor has released a fix as referenced in the official changelog at https://www.booking-wp-plugin.com/change-log/ and changeset 3480956. Administrators should verify the update through WordPress admin panel (Plugins > Installed Plugins > Bookly) and confirm the new version is running. As a temporary workaround pending update, disable the tips/gratuity feature in Bookly settings if business requirements permit, or implement Web Application Firewall (WAF) rules to reject booking requests with negative tip values. Server-side validation fixes should ensure all pricing fields are recalculated server-side from the configured appointment rates, never trusting client-supplied values for financial calculations.