CVE-2026-12626: Bookly WordPress Plugin Object Injection

CVE-2026-12626 Overview

CVE-2026-12626 is a PHP Object Injection vulnerability in the Bookly plugin for WordPress, an online scheduling and appointment booking system. The flaw affects all versions up to and including 28.2. It stems from deserialization of untrusted input passed through the value parameter. Authenticated attackers holding custom-level access or higher can inject arbitrary PHP objects into the application. No known gadget chain exists in the plugin itself, which limits immediate exploitation. However, the presence of additional plugins or themes containing exploitable gadget chains could allow attackers to escalate the issue to code execution, file deletion, or data exfiltration.

Critical Impact
Authenticated users with custom-level roles can inject PHP objects, potentially chaining with gadgets from other installed components to achieve remote code execution.

Affected Products

Bookly – Online Scheduling and Appointment Booking System plugin for WordPress
All versions up to and including 28.2
WordPress installations where the plugin is active and custom roles are provisioned

Discovery Timeline

2026-10-10 - CVE-2026-12626 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-12626

Vulnerability Analysis

The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. The Bookly plugin accepts user-supplied data via the value parameter and passes it to a PHP deserialization routine without sufficient validation. When PHP processes serialized data, it reconstructs objects and invokes magic methods such as __wakeup() or __destruct(). An attacker who controls serialized input can craft objects whose magic methods trigger unintended behavior.

The Wordfence advisory confirms no known gadget chain exists within Bookly itself. Exploitation therefore depends on gadgets available in co-installed plugins, themes, or the WordPress core. Many popular WordPress ecosystems contain such gadgets, so the risk is realistic in production environments.

Root Cause

The root cause is the use of unserialize() on attacker-controlled input reaching the value parameter. The plugin trusts data provided by authenticated users with custom-level access rather than restricting deserialization to known-safe payload formats such as JSON.

Attack Vector

Exploitation requires network access to the WordPress site and valid authentication at custom role level or above. The attacker submits a crafted serialized PHP object through a request that reaches the vulnerable parameter. Upon deserialization, the injected object is instantiated and its magic methods execute during the normal PHP object lifecycle.

Details of the code change are available in the WordPress plugin changeset 3707284 and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-12626

Indicators of Compromise

HTTP requests containing serialized PHP payloads in the value parameter, typically beginning with O:, a:, or s: tokens
Unexpected PHP errors referencing __wakeup, __destruct, or class not found during Bookly request handling
Creation, modification, or deletion of unexpected files on the webroot following Bookly API calls
New or modified WordPress users, options, or scheduled tasks created shortly after authenticated Bookly activity

Detection Strategies

Inspect web server and PHP logs for POST requests to Bookly endpoints containing serialized object signatures
Alert on PHP fatal errors or exceptions tied to deserialization during normal plugin operation
Correlate custom-role user activity with changes to WordPress core files, uploaded content, or the wp_options table

Monitoring Recommendations

Monitor WordPress audit logs for role assignments granting custom-level permissions
Enable a web application firewall rule set that flags serialized PHP objects in request parameters
Track outbound connections from the web server that could indicate successful code execution

How to Mitigate CVE-2026-12626

Immediate Actions Required

Update the Bookly plugin to a version later than 28.2 as soon as a patched release is published by the vendor
Audit WordPress accounts and remove unnecessary custom-level or elevated roles
Review installed plugins and themes for known PHP object injection gadget chains and remove any that are unused

Patch Information

The code change addressing the vulnerability is tracked in the WordPress plugin changeset 3707284. Site operators should upgrade to the fixed Bookly release referenced in the Wordfence Vulnerability Report.

Workarounds

Restrict access to Bookly administrative functions using IP allowlists at the web server or firewall layer
Deploy WAF signatures that block serialized PHP object patterns in request bodies and query strings
Temporarily disable the Bookly plugin on sites where patching cannot be performed immediately

bash

# Example WAF rule concept to block serialized PHP objects in the 'value' parameter
# ModSecurity-style pseudo-rule
SecRule ARGS:value "@rx ^(O|a|s):[0-9]+:" \
    "id:1026126,phase:2,deny,status:403,msg:'Possible PHP object injection in Bookly value parameter'"