CVE-2026-104898 Overview
CVE-2026-104898 is an Insecure Direct Object Reference (IDOR) vulnerability in the Bookly plugin for WordPress, an online scheduling and appointment booking system. The flaw affects all versions up to and including 28.4. Authenticated attackers with subscriber-level access can overwrite the WordPress account binding of any Bookly staff record by manipulating the id and wp_user_id parameters. This allows an attacker to hijack a higher-privileged staff member's account association, including those owned by administrators, resulting in privilege escalation. The vulnerability is tracked under [CWE-639] (Authorization Bypass Through User-Controlled Key).
Critical Impact
Authenticated subscribers linked to a Bookly staff record can reassign an administrator's staff binding to their own WordPress account, effectively hijacking the administrator's association within the plugin and escalating privileges.
Affected Products
- Bookly – Online Scheduling and Appointment Booking System plugin for WordPress
- All versions up to and including 28.4
- Installations where bookly_gen_allow_staff_edit_profile is enabled (default on fresh installs)
Discovery Timeline
- 2026-10-10 - CVE-2026-104898 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-104898
Vulnerability Analysis
The vulnerability resides in the staff edit AJAX handler within backend/components/dialogs/staff/edit/Ajax.php. The handler accepts the id and wp_user_id parameters from the request and persists them to the targeted Bookly staff entity without verifying that the authenticated user has authorization to modify the referenced staff record. Because the key is user-controlled and not bound to the current session's identity, an attacker can specify an arbitrary staff id, including those linked to administrator accounts, and reassign the wp_user_id to any WordPress user. The result is an account-binding takeover that reroutes the plugin's role mapping to the attacker.
Root Cause
The root cause is missing authorization validation on a user-controlled key, classified as [CWE-639]. The affected code paths in Ajax.php (lines 93, 111, 364) and the underlying entity logic in lib/base/Entity.php and lib/base/Request.php do not enforce ownership checks before updating the staff entity. Any authenticated user able to reach the endpoint can mutate records belonging to other users.
Attack Vector
Exploitation requires the attacker to hold at least subscriber-level credentials on the WordPress site and to be linked to at least one Bookly staff record. This precondition is satisfied by default when an administrator enables the bookly_gen_allow_staff_edit_profile option, which is active on fresh installs. The attacker submits a crafted request to the staff edit AJAX endpoint containing the target staff id and the attacker's own wp_user_id, overwriting the account binding. The attack is network-exploitable but requires authentication and specific linkage preconditions, per the published Wordfence Vulnerability Analysis.
No verified proof-of-concept code is published. See the WordPress Plugin Code Review for the vulnerable handler.
Detection Methods for CVE-2026-104898
Indicators of Compromise
- Unexpected modifications to Bookly staff records where the wp_user_id field has changed to a lower-privileged account.
- AJAX POST requests to the Bookly staff edit endpoint from subscriber-level accounts referencing staff id values the user does not own.
- Audit log entries showing administrator staff records being edited by non-administrative users.
Detection Strategies
- Review the bookly_staff database table for records whose wp_user_id no longer matches the originally assigned staff owner.
- Correlate WordPress authentication logs with Bookly plugin AJAX activity to identify subscribers invoking staff management endpoints.
- Alert on AJAX actions targeting admin-ajax.php with Bookly staff edit parameters originating from non-admin session cookies.
Monitoring Recommendations
- Enable WordPress audit logging to capture plugin option changes and staff record updates.
- Monitor outbound session changes and privilege transitions for accounts tied to Bookly staff entries.
- Track changes to the bookly_gen_allow_staff_edit_profile setting and alert when it is toggled on.
How to Mitigate CVE-2026-104898
Immediate Actions Required
- Update the Bookly plugin to version 28.5 or later, which contains the authorization fix per the Plugin Change Log Entry.
- Audit all Bookly staff records and verify that each wp_user_id binding matches the intended WordPress user.
- Review WordPress user accounts for unauthorized privilege changes and rotate credentials where tampering is suspected.
Patch Information
The vendor addressed the issue in Bookly version 28.5. The patch introduces authorization checks on the staff edit AJAX handler to prevent authenticated users from modifying staff records they do not own. Administrators should upgrade through the WordPress plugin management interface or deploy the updated package directly.
Workarounds
- Disable the bookly_gen_allow_staff_edit_profile option until the plugin can be upgraded.
- Restrict subscriber-level account creation on the WordPress site, or require administrative approval before enabling self-registration.
- Unlink non-administrative WordPress users from Bookly staff records where the association is not required for business operations.
# Configuration example: disable the vulnerable option via WP-CLI
wp option update bookly_gen_allow_staff_edit_profile 0
wp plugin update bookly-responsive-appointment-booking-tool --version=28.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
