Ladela
Monthly
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Stored cross-site scripting in the Bookly Online Scheduling and Appointment Booking System plugin for WordPress (versions through 27.2) allows remote unauthenticated attackers to inject arbitrary JavaScript via the 'bookly-customer-full-name' cookie, which is rendered without proper sanitization or output escaping. Exploitation is gated by the non-default 'Remember personal information in cookies' setting being enabled, and no public exploit identified at time of analysis. The flaw was reported by Wordfence and the upstream fix landed in changeset 3504922 in the WordPress plugin repository.
Unauthenticated attackers who already know a registered customer's primary phone number or email can read that customer's stored name, email, phone and internal notes from WordPress sites running the Bookly - Online Scheduling and Appointment Booking System plugin in versions up to and including 28.4. The classic booking form's Details step endpoint bookly_render_details is registered for wp_ajax_nopriv, its csrfTokenValid() check is overridden to always return true, and InfoText::getCodes() loads a persisted Customer entity keyed solely by the attacker-supplied phone or email without ever calling the plugin's customerIdentityConfirmed() predicate, so {client_name}, {client_email}, {client_phone} and {client_note} placeholders are substituted into the returned HTML. Exploitation requires a non-default site configuration (the administrator must have inserted at least one of those placeholders into the Details step's Appearance information text) and a valid victim identifier, which limits this to targeted per-victim disclosure rather than bulk enumeration; no public exploit was identified at time of analysis. The flaw is fixed in Bookly 28.5.
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers with subscriber-level access to overwrite the WordPress user binding of any Bookly staff record, including those owned by administrators, by manipulating the 'id' and 'wp_user_id' parameters in the staff-edit AJAX endpoint. Exploitation requires the attacker to have a subscriber account and to be linked to at least one Bookly staff record, a condition present by default on fresh installs where the bookly_gen_allow_staff_edit_profile option is enabled. No public exploit code has been identified and CISA KEV does not list this vulnerability; the assessed CVSS is 6.8 with high attack complexity (AC:H) due to the prerequisite of a staff-linked subscriber account.
Unauthenticated attackers can overwrite the name, email, phone, and address of any existing customer record in the Bookly WordPress plugin (Online Scheduling and Appointment Booking System - Bookly, all versions up to and including 28.2), hijacking that customer's booking notifications. The flaw is a PHP type-juggling authorization bypass: the plugin compares a session-stored one-time verification code against the attacker-supplied verification_code using a loose != operator, and because the booking AJAX controller registers its methods as wp_ajax_nopriv_ handlers and unconditionally forces csrfTokenValid() to return true, the endpoint is both unauthenticated and CSRF-unprotected. Submitting the JSON boolean true as the verification_code through the json_data channel - which json_decode() passes through with its real PHP type intact so that wp_kses leaves it untouched - satisfies the loose comparison against the non-zero integer code and bypasses the phone/email ownership check. Severity is moderate (CVSS 5.3, integrity-only impact); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
Price manipulation in Bookly WordPress plugin (versions up to 27.0) allows unauthenticated attackers to reduce appointment booking costs to zero by submitting negative values to the 'tips' parameter, exploiting insufficient server-side validation of user-supplied pricing input. No public exploit code or active exploitation has been confirmed, but the vulnerability carries moderate risk due to its ease of exploitation and direct financial impact on e-commerce transactions.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Unauthenticated attackers can exploit an insecure direct object reference in the Bookly appointment-booking plugin for WordPress (all versions up to and including 28.2) to enumerate sequential order IDs and disclose other customers' secret order tokens, retrieve appointment and calendar details, and permanently delete non-completed bookings. The chain requires only a reachable public booking form and the plugin's standard AJAX endpoints; no authentication, user interaction, or non-default configuration is needed, which is why the assessed severity remains high (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) despite the confidentiality impact being narrower than full data compromise. At time of analysis there is no public exploit code and no confirmed active exploitation (no CISA KEV listing), but the sequential-ID prerequisite is trivially satisfied on typical installations, making opportunistic abuse realistic.
Unauthenticated attackers can read the complete AI booking conversation transcript of any Bookly customer — including names, email addresses, phone numbers and appointment details — because the plugin's 'conversation_id' parameter is never checked against an owner, and conversation IDs are sequential integers that can simply be incremented. The same endpoint also allows arbitrary messages to be injected into a victim's conversation, which are then replayed to the Cloud AI worker together with the full private history, enabling data poisoning and prompt-injection against the assistant. The flaw affects all versions of the Online Scheduling and Appointment Booking System – Bookly plugin through 28.1; no public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Stored cross-site scripting in the Bookly Online Scheduling and Appointment Booking System plugin for WordPress (versions through 27.2) allows remote unauthenticated attackers to inject arbitrary JavaScript via the 'bookly-customer-full-name' cookie, which is rendered without proper sanitization or output escaping. Exploitation is gated by the non-default 'Remember personal information in cookies' setting being enabled, and no public exploit identified at time of analysis. The flaw was reported by Wordfence and the upstream fix landed in changeset 3504922 in the WordPress plugin repository.
Unauthenticated attackers who already know a registered customer's primary phone number or email can read that customer's stored name, email, phone and internal notes from WordPress sites running the Bookly - Online Scheduling and Appointment Booking System plugin in versions up to and including 28.4. The classic booking form's Details step endpoint bookly_render_details is registered for wp_ajax_nopriv, its csrfTokenValid() check is overridden to always return true, and InfoText::getCodes() loads a persisted Customer entity keyed solely by the attacker-supplied phone or email without ever calling the plugin's customerIdentityConfirmed() predicate, so {client_name}, {client_email}, {client_phone} and {client_note} placeholders are substituted into the returned HTML. Exploitation requires a non-default site configuration (the administrator must have inserted at least one of those placeholders into the Details step's Appearance information text) and a valid victim identifier, which limits this to targeted per-victim disclosure rather than bulk enumeration; no public exploit was identified at time of analysis. The flaw is fixed in Bookly 28.5.
Privilege escalation in the Bookly WordPress plugin (versions up to and including 28.4) allows authenticated attackers with subscriber-level access to overwrite the WordPress user binding of any Bookly staff record, including those owned by administrators, by manipulating the 'id' and 'wp_user_id' parameters in the staff-edit AJAX endpoint. Exploitation requires the attacker to have a subscriber account and to be linked to at least one Bookly staff record, a condition present by default on fresh installs where the bookly_gen_allow_staff_edit_profile option is enabled. No public exploit code has been identified and CISA KEV does not list this vulnerability; the assessed CVSS is 6.8 with high attack complexity (AC:H) due to the prerequisite of a staff-linked subscriber account.
Unauthenticated attackers can overwrite the name, email, phone, and address of any existing customer record in the Bookly WordPress plugin (Online Scheduling and Appointment Booking System - Bookly, all versions up to and including 28.2), hijacking that customer's booking notifications. The flaw is a PHP type-juggling authorization bypass: the plugin compares a session-stored one-time verification code against the attacker-supplied verification_code using a loose != operator, and because the booking AJAX controller registers its methods as wp_ajax_nopriv_ handlers and unconditionally forces csrfTokenValid() to return true, the endpoint is both unauthenticated and CSRF-unprotected. Submitting the JSON boolean true as the verification_code through the json_data channel - which json_decode() passes through with its real PHP type intact so that wp_kses leaves it untouched - satisfies the loose comparison against the non-zero integer code and bypasses the phone/email ownership check. Severity is moderate (CVSS 5.3, integrity-only impact); no public exploit code has been identified at time of analysis and there is no confirmed active exploitation.
Unauthorized plugin update execution in the Bookly scheduling plugin for WordPress (all versions through 27.2) allows any authenticated Subscriber-level user to force co-installed plugins whose main entry point is named `main.php` to update to their latest version, bypassing WordPress's standard `update_plugins` capability gate. The root cause is a missing capability check (CWE-862) on the `updateAddon` function in `lib/PluginsUpdater.php`, as identified by Wordfence and confirmed by the WordPress plugin SVN diff. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the low authentication bar makes it relevant on open-registration or multi-tenant WordPress sites.
Insecure Direct Object Reference in the Bookly plugin's Mobile Staff Cabinet API (versions up to and including 27.7) allows any authenticated staff member to read appointment records belonging to other staff by supplying arbitrary sequential appointment IDs. The exposure includes sensitive customer PII - full names, email addresses, phone numbers, internal notes, custom fields, and payment metadata (total, type, status) - with no active exploitation confirmed (not in CISA KEV) and no public POC identified at time of analysis. The flaw is especially notable because sibling API methods in the same codebase correctly enforce staff-scoped ownership checks, making this a targeted authorization omission rather than a systemic design failure.
Price manipulation in Bookly WordPress plugin (versions up to 27.0) allows unauthenticated attackers to reduce appointment booking costs to zero by submitting negative values to the 'tips' parameter, exploiting insufficient server-side validation of user-supplied pricing input. No public exploit code or active exploitation has been confirmed, but the vulnerability carries moderate risk due to its ease of exploitation and direct financial impact on e-commerce transactions.