Bookly EUVD-2026-96221

Requires an authenticated WordPress session with Bookly 'custom-level' role access or above, and submission of a serialized payload to the plugin's 'value' parameter, which is deserialized without validation in all versions up to and including 28.2. The decisive limiting factor is that no known gadget chain is available: successful code execution or data impact depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, so default installations without such a gadget face injection without a direct exploit path. Secondary limits are the required authentication (not exploitable by anonymous visitors) and the version ceiling of 28.2.

This is a PHP Object Injection flaw (CWE-502) in the Bookly WordPress plugin, reported by Wordfence, carrying a vendor CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The network vector and low attack complexity are offset by the PR:H requirement - exploitation requires an authenticated account. The description qualifies this as 'custom-level access and above,' which in Bookly's own role model is a relatively low-privilege staff/customer tier rather than full administrator, creating mild tension with the PR:H metric; this is worth verifying against the plugin's capability mapping, as the real barrier to entry may be lower than PR:H suggests. The most significant risk-dampening signal is explicit in the description: 'No known gadget chain is available.' Object injection alone does not yield code execution or data impact without a usable gadget chain (in Bookly, another installed plugin/theme, or WordPress core), so the C:H/I:H/A:H impact ratings represent the ceiling if a gadget is present rather than guaranteed outcomes. No EPSS score, CISA KEV listing, or public exploit was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net assessment: a genuine, patchable injection primitive that becomes high-severity only in environments where a reachable gadget chain exists; as a standalone issue it is a medium-priority, authenticated hardening fix rather than an emergency.

An attacker who holds a custom-level (or higher) Bookly account submits a crafted serialized payload through the vulnerable 'value' parameter, causing the plugin to deserialize attacker-controlled input into a live PHP object. If a suitable gadget chain is present in the site's plugins, theme, or WordPress core, that object's lifecycle methods can be abused to read files, write data, or execute code; without such a chain the injection is currently inert. No public exploit code was identified at time of analysis, and the advisory explicitly states no known gadget chain is available.