Bookly WordPress Plugin EUVD-2026-59850

Exploitation requires the attacker to hold a valid access_key token bound to a Staff entity in the Bookly plugin - at minimum, they must be an authenticated staff-level user of the scheduling system (not a WordPress subscriber or unauthenticated visitor). The Mobile Staff Cabinet API feature must be enabled, which is part of the plugin's standard functionality. Exploitation is read-only: the specific flaw in appointment() does not permit modification or deletion of appointments - those sibling methods enforce proper ownership checks. The vulnerability is limited to WordPress sites running Bookly version 27.7 or earlier. Sequential appointment IDs make enumeration trivial, but possession of at least one valid staff credential or access_key token is a firm and non-negotiable prerequisite.

The provided CVSS 4.3 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is well-calibrated: network-accessible, low complexity, no integrity or availability impact, but firmly gated behind staff-level authentication (PR:L). No EPSS score was provided, so exploitation probability cannot be quantified from available data. No KEV listing and no known public POC further reduce immediate urgency. Despite the moderate CVSS rating, the real-world privacy and regulatory risk may exceed what the score conveys: a rogue or compromised staff member could enumerate all appointment IDs and exfiltrate customer PII and payment metadata across the entire organization in a single scripted session. For businesses subject to GDPR or CCPA, this breach vector carries outsized compliance risk. The low attack complexity (sequential IDs, no brute-force or cryptographic requirement) means the practical exploitation bar is very low for anyone already holding valid staff credentials.

A staff member with a valid Mobile Staff Cabinet access_key token crafts HTTP requests to the bookly_mobile_staff_cabinet endpoint with resource=appointment and action=appointment, iterating integer values in params[id] from 1 upward. For each appointment belonging to any other staff member, the server returns the full record including customer name, email, phone, payment details, and internal notes without any ownership check. No public POC has been disclosed, but the attack requires no specialized tooling - a browser, curl, or any HTTP client suffices once a valid staff token is in hand.