Online Scheduling and Appointment Booking System <= 28.4 — Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
CVE-2026-104898Published · Updated Action summary
Affected: ≤28.4Update to 28.5 or newer
All remediation steps- Severity
- Medium6.8
- CVSS
- 6.8CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NWhat does this vector mean?
AV:NAttack vector- Network
AC:HAttack complexity- High
PR:LPrivileges required- Low
UI:NUser interaction- None
S:UScope- Unchanged
C:HConfidentiality- High
I:HIntegrity- High
A:NAvailability- None
- Required access
- Unknown
- Exploit prediction (EPSS)
- 0.2% chance in 30 days16th percentile
- CISA KEV
- Not listed
On this page8
Am I affected?
Online Scheduling and Appointment Booking System – Bookly bookly-responsive-appointment-booking-tool
- Affected≤ 28.4
- Patched in28.5
Update to 28.5 or newer.
You are affected if you run ≤ 28.4. Version 28.5 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Online Scheduling and Appointment Booking System – Bookly.
- No admin access? Run a passive check of your site. It reads public files only.
What to do
- Update to version 28.5, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch Online Scheduling and Appointment Booking System – Bookly to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Wordfence PRISM.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in Online Scheduling and Appointment Booking System – Bookly
All 32| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | Authenticated (Custom+) PHP Object Injection via 'value' Parameter ≤28.2Update to 28.3 | CVE-2026-12626 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details ≤28.4Update to 28.5 | CVE-2026-103365 | |
| Medium4.3 | Authenticated (Staff+) Insecure Direct Object Reference ≤28.2Update to 28.3 | CVE-2026-86839 | |
| Medium5.3 | Unauthenticated Payment Bypass ≤28.2Update to 28.3 | CVE-2026-86838 | |
| High7.5 | 28.2 - Authenticated (Bookly Administrator+) PHP Object Injection 23.2 – 28.2Update to 28.3 | CVE-2026-86841 |
- High7.2Authenticated (Custom+) PHP Object Injection via 'value' Parameter
≤28.2Update to 28.3
- Medium5.3Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
≤28.4Update to 28.5
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
≤28.2Update to 28.3
- Medium5.3Unauthenticated Payment Bypass
≤28.2Update to 28.3
- High7.528.2 - Authenticated (Bookly Administrator+) PHP Object Injection
23.2 – 28.2Update to 28.3
Timeline
CVE published
Severity medium, CVSS 6.8
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- EPSS
- Exploit Prediction Scoring System by FIRST.org.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.