Bookly EUVD-2026-96040

Exploitation requires a specific non-default site configuration: the administrator must have inserted at least one of the {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the classic booking form's Details step 'Appearance' information text - without these placeholders no customer data is substituted and the bug is not reachable. The attacker must also already possess a valid registered customer's primary phone number (or email), since the Customer entity is looked up by that attacker-supplied value; this limits the flaw to per-victim targeted disclosure rather than bulk enumeration. Offsetting these limits, no authentication, CSRF token, or user interaction is needed (the endpoint is registered for wp_ajax_nopriv, csrfTokenValid() is forced true, and customerIdentityConfirmed() is never called), so any such configured site is remotely reachable by anonymous attackers. Affected: Bookly versions up to and including 28.4; fixed in 28.5.

This is a genuine but moderate-severity information-disclosure issue, and the signals are internally consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, 5.3) correctly reflects remote, unauthenticated access with only limited confidentiality impact and no integrity or availability effect - matching the description, which confirms the dual wp_ajax/wp_ajax_nopriv registration, the csrfTokenValid() override returning true, and the missing customerIdentityConfirmed() check. No EPSS score, KEV listing, or public POC is present in the supplied data, so exploitation is not confirmed in the wild; this is not a drop-everything priority. The practical risk is bounded by two real-world gatekeepers that CVSS does not fully capture: the site owner must have placed {client_name}/{client_email}/{client_phone}/{client_note} placeholders into the Details step's Appearance text (a non-default configuration), and the attacker must already know a valid registered customer's primary phone or email. The disclosure is also per-customer rather than a bulk dump, which argues for targeted abuse (e.g., confirming/profiling a specific known individual) over mass automated harvesting. Net: a credible privacy/PII-exposure bug worth patching promptly on affected, placeholder-configured sites, but lower urgency than a critical RCE given the limited impact and configuration dependency.

An attacker who already knows a target customer's registered phone number (or email) submits a crafted request to the unauthenticated bookly_render_details AJAX endpoint of a Bookly site whose Details step Appearance text contains customer placeholders. Because the CSRF check is bypassed and no identity confirmation is performed, the server loads the matching Customer entity and returns HTML containing that person's stored name, email, phone, and internal notes. No public exploit code is identified in the provided data, but the low attack complexity makes manual exploitation straightforward.