Bookly CVE-2026-96348

No special conditions - remote unauthenticated exploitation against default configurations of the Bookly (bookly-responsive-appointment-booking-tool) WordPress plugin at versions <= 28.2. The vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required; the only prerequisite is that the target WordPress site runs a vulnerable Bookly version with the affected endpoint reachable. Impact is limited to integrity (I:H, C:N/A:N), so the realistic outcome is unauthorized modification/creation of data rather than disclosure or denial of service.

This is a genuine priority-worthy issue on the exploitability side but with a bounded impact profile. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5) describes a fully remote, unauthenticated, low-complexity attack requiring no user interaction - the easiest exploitation profile that exists - which aligns with the description of 'Unauthenticated Broken Access Control' and CWE-862 (Missing Authorization). However, the impact is deliberately scoped to integrity only (I:H, with C:N and A:N), meaning an attacker can create, modify, or manipulate protected state/data via functionality that fails to enforce an authorization check, but cannot directly read confidential data or take the site down through this flaw alone. No EPSS score, KEV listing, SSVC decision, or POC indicator is provided in the input, so there is no signal of active exploitation or public exploit code - currently no public exploit identified at time of analysis. The main caveat is data sparsity: the Patchstack reference is the sole source and the description does not name the exact vulnerable endpoint/action, so the precise integrity impact (e.g., altering bookings, injecting data, overwriting settings) cannot be confirmed from the input. Net: high real-world exploitability but medium overall priority, gated by a widely-deployed-but-not-ubiquitous WordPress plugin and integrity-only impact.

An unauthenticated attacker sends a crafted HTTP request directly to a Bookly plugin endpoint (e.g., an AJAX action or REST route) that performs a privileged operation without verifying the caller's authorization. Because no login, user interaction, or special configuration is required, the attacker manipulates protected booking data or settings that should be restricted to authenticated/privileged users. No public proof-of-concept is indicated in the provided data.