Bookly Plugin CVE-2026-2520

Exploitation requires a valid WordPress user account with at least Subscriber-level access - the lowest role assignable upon registration on sites with open registration. No administrator interaction or elevated privilege is needed beyond this baseline authenticated session. The vulnerable updateAddon function is reachable over the network via the standard WordPress AJAX endpoint with no additional configuration of the Bookly plugin required. The primary limiting factor is that only co-installed WordPress plugins whose main entry file is named exactly main.php are targetable for forced updates; plugins using the common plugin-slug.php naming convention are not affected by this specific call path. Sites with closed user registration, mandatory administrator approval for new accounts, or no co-installed plugins matching the main.php naming pattern have materially reduced practical exposure.

The CVSS 5.4 Medium score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects a realistic calibration: the attack is network-reachable and low-complexity, but the actual impact of a forced plugin update is bounded - no arbitrary code can be injected directly via this function alone. The practical blast radius depends entirely on what co-installed plugins with main.php entry points exist and whether their latest versions introduce breaking changes or secondary vulnerabilities. No EPSS score is available in the provided intelligence, no KEV listing exists, and no public POC has been identified, all of which support treating this as a standard patching priority rather than an emergency. That said, even a mid-sized municipal IT team in gdynia operating a public-facing WordPress booking portal with open user registration should treat this as worth patching in the next maintenance window, since any registered account is sufficient for exploitation and the update trigger can cause site instability. The 'Authentication Bypass' tag in the input metadata is a mislabel and should not elevate the perceived severity - the vulnerability specifically requires an authenticated session.

An attacker registers a free account on a WordPress site running Bookly ≤27.2 with open registration enabled, gaining Subscriber-level access. The attacker sends an authenticated POST request to the updateAddon AJAX action without possessing the update_plugins capability, which the function does not verify. If a co-installed plugin uses main.php as its entry point, that plugin is forced to update to its latest version, potentially introducing a breaking change, a regression, or a secondary vulnerability present in the newer release.