EUVD-2026-88099
GHSA-8vmp-w5gv-wxrj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public Bookly booking form
-
DeliveryCraft request with manipulated quantity value
-
ExploitServer computes appointment total as zero
-
ExecutionBooking confirmed bypassing payment step
-
ImpactPaid service obtained free (revenue loss)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security Server-side parameter enforcement
|
| Exploitation Conditions | Requires a publicly reachable WordPress site running the Bookly plugin at a version before 28.3 with a bookable paid service exposed on the front-end booking form; exploitation is remote and unauthenticated (PR:N/UI:N) against the standard booking workflow, with no special configuration mentioned. The limiting factor is not access but scope: the attacker only manipulates the client-supplied booking quantity to zero the total, so impact is confined to fraudulent free/underpriced bookings (integrity), with no confidentiality or availability effect. Sites that do not sell paid services through Bookly, or that are already on 28.3+, are not exposed. |
| Impact | This is a genuine but moderate-severity business-logic flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3) is internally consistent with the description: network-reachable, low complexity, no privileges (unauthenticated), no user interaction, and integrity-only impact - the attacker manipulates a client-supplied booking quantity to zero out the total and obtain paid services for free. No EPSS score, no CISA KEV listing, and no SSVC decision data were provided, so widespread or automated exploitation cannot be inferred from those signals; however, a public exploit from WPScan does exist, lowering the barrier to opportunistic abuse. The 5.3 rating understates business impact for merchants (direct revenue loss / free service fulfillment) even though the technical CVSS integrity metric is only Low. Net: a real, easily-triggered financial-fraud issue against affected installs, but not a system-compromise or mass-exploitation event - prioritize patching where Bookly processes real payments, treat as medium urgency otherwise. Note: CWE is unassigned (N/A) in the input; the behavior maps to client-side enforcement of a server-side value (CWE-602/472), not the 'Authentication Bypass' the tag implies. |
| Exploit ScenarioDerived | An unauthenticated visitor to a WordPress site running Bookly intercepts or crafts the booking request and sets the client-supplied quantity so the server computes an appointment total of zero, then completes the booking without ever reaching the payment step - receiving a paid service for free. A public exploit reference is available via WPScan, so no novel research is required to reproduce it against unpatched (<28.3) installs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Unauthenticated attackers can zero out the price of paid appointments in the Bookly WordPress plugin before 28.3 by manipulating the client-supplied booking quantity that the plugin uses to compute the appointment total, allowing them to book paid services for free and skip the payment step entirely. The issue is a server-side validation gap in the booking total calculation, and publicly available exploit code exists, so any publicly reachable WordPress site running an affected version with a paid service exposed on the front-end booking form is remotely exploitable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N). Impact is confined to integrity - fraudulent or underpriced bookings - with no confidentiality or availability effect, and there is no CISA KEV confirmation of active exploitation at time of analysis.
RemediationAI
Vendor-released patch: upgrade the Bookly WordPress plugin to version 28.3 or later, which is the fixed release identified by the pre-28.3 affected range in the advisory (see https://wpscan.com/vulnerability/1c8a53e7-5556-4dcb-a461-c6df253d0b7a/ for the vendor notification). If immediate upgrade is not possible, prioritize remediation on sites that expose paid services through the Bookly front-end booking form, since those are the only installations where the logic flaw yields a free-service outcome; for such sites, a practical compensating control is to temporarily unpublish paid services from Bookly or switch them to manual/enquiry-only booking, at the cost of losing online paid bookings until patched. Sites that only offer free or staff-mediated appointments can treat this as lower urgency, but should still schedule the 28.3 update. Additional hardening options with trade-offs: put the booking endpoint behind rate limiting or a WAF rule that rejects booking requests with manipulated quantity or total fields, which may break legitimate multi-attendee bookings if tuned too aggressively; and add server-side reconciliation of the recorded appointment total against the expected price (for example, flagging or cancelling zero-total bookings for paid services) to detect and reverse fraudulent bookings, though this requires custom development and manual review effort. Note the absence of any vendor statement that 28.3 is a security-only release; validate the update in a staging environment first because booking and payment plugin updates can alter the checkout workflow.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Bookly is a WordPress appointment-booking plugin that lets site owners publish bookable services (including paid ones) through a front-end booking form and collect payment as part of the booking workflow. The flaw is a server-side trust boundary failure: the quantity value submitted with the booking request is accepted by the server and fed directly into the appointment total calculation without re-validation against expected per-service minimums or against the authoritative price data. No CWE identifier was assigned in the source data, but the root-cause class is improper validation of client-controlled input combined with client-side enforcement of a server-side security decision - the plugin effectively lets the booking request dictate the amount owed. Because the calculation happens before the payment step, an attacker can drive the total to zero and complete a booking for a paid service without paying. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that the prerequisite is only network reachability of the booking form, not credentials, and that the resulting loss is a low-severity integrity violation (wrong/fraudulent booking records and unpaid service delivery). The supplied CPE string (cpe:2.3:a:unknown:bookly:*:*:*:*:*:*:*:*) enumerates the Bookly plugin with an unresolved vendor namespace and a wildcard version, so the CPE alone does not bound the affected range; the version boundary comes from the vendor/product description (< 28.3).
Know when Bookly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network request against the booking endpoint (AV:N/AC:L/PR:N/UI:N); integrity-only impact from tampering with pricing (I:L), no data disclosure or service loss (C:N/A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.4 does not properly sanitise and escape a
Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js. R
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 20.3.1 does not escape the Staff Full Name fi
Unauthenticated customer record tampering in the Bookly WordPress plugin before 28.3 lets remote attackers overwrite a k
SQL injection in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets remote, unauthenticate
The WordPress Online Booking and Scheduling Plugin WordPress plugin before 22.5 does not sanitise and escape some of its
Unauthenticated remote attackers can modify or create data in WordPress sites running the Bookly appointment booking plu
Sensitive data exposure in the Bookly WordPress appointment booking plugin (versions 27.4 and earlier) allows remote una
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Bookly, a WordPress appointment booking plugin, affecting
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) let
Authenticated Subscriber-level users can modify other users' booking-related objects in the Bookly WordPress plugin thro
The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to,
Exploit-DB