CVE-2026-2519: Bookly WordPress Plugin Auth Bypass Flaw

CVE-2026-2519 Overview

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the tips parameter in all versions up to, and including, 27.0. This vulnerability stems from the plugin trusting user-supplied input without proper server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the tips parameter, causing the total price to be reduced to zero.

Critical Impact

Unauthenticated attackers can manipulate booking prices to zero by submitting negative values in the tips parameter, enabling theft of services.

Affected Products

• Bookly – Online Scheduling and Appointment Booking System plugin for WordPress versions up to and including 27.0

Discovery Timeline

• April 9, 2026 - CVE CVE-2026-2519 published to NVD
• April 9, 2026 - Last updated in NVD database

Technical Details for CVE-2026-2519

Vulnerability Analysis

This vulnerability is classified as CWE-472 (External Control of Assumed-Immutable Web Parameter). The Bookly plugin fails to implement proper server-side validation for the tips parameter during the booking checkout process. When processing booking requests, the application accepts the tip amount directly from user input without validating that the value is non-negative or within reasonable bounds. An attacker can exploit this by submitting a negative tip value large enough to reduce the total transaction amount to zero or a minimal value.

The vulnerability exists across multiple files in the plugin architecture. The affected code paths include the Ajax handler in the frontend booking module, the CartInfo calculation logic, and the UserBookingData processing functions. Each of these components trusts the user-supplied tips value without implementing proper input validation or bounds checking.

Root Cause

The root cause of this vulnerability is insufficient input validation on the tips parameter. The plugin assumes that users will only submit positive tip values, but it does not enforce this assumption on the server side. This allows malicious users to submit arbitrary negative values that are then used in price calculations, effectively creating a discount that was never intended by the site administrator.

Attack Vector

The attack can be executed over the network without requiring any authentication or user interaction. An attacker simply needs to intercept or craft a booking request and modify the tips parameter to include a negative value. When the server processes this request, the negative tip is subtracted from the total price, potentially reducing it to zero.

The exploitation process involves:

1. Initiating a normal booking flow on a WordPress site running the vulnerable Bookly plugin
2. Intercepting the checkout request using a proxy tool or browser developer tools
3. Modifying the tips parameter to a negative value equal to or greater than the service price
4. Submitting the modified request to complete the booking at a manipulated price

Technical details can be found in the WordPress Plugin Ajax Code, CartInfo Code, and UserBookingData Code.

Detection Methods for CVE-2026-2519

Indicators of Compromise

• Booking transactions with zero or significantly reduced total prices
• Negative values appearing in tip fields within booking database records
• Anomalous booking patterns showing services rendered without corresponding revenue
• Log entries showing modified HTTP requests with negative numerical parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing negative values in numeric parameters
• Configure server-side logging to capture all booking transaction details including tip amounts
• Set up database queries to periodically scan for bookings with negative tip values or suspicious pricing

Monitoring Recommendations

• Enable detailed access logging on the WordPress server to capture all POST requests to Bookly endpoints
• Configure alerting for bookings completed with total amounts significantly below configured service prices
• Implement real-time monitoring for HTTP parameter manipulation attempts targeting the booking workflow

How to Mitigate CVE-2026-2519

Immediate Actions Required

• Update the Bookly plugin to version 27.1 or later immediately
• Review recent booking transactions for signs of price manipulation exploitation
• Temporarily disable the tips feature if immediate patching is not possible
• Implement WAF rules to block negative values in the tips parameter

Patch Information

The vendor has released a security update addressing this vulnerability. The patch implements server-side validation to ensure the tips parameter only accepts non-negative values. Details of the fix can be found in the WordPress Change Set Log and the Booking WP Plugin Changelog.

Additional vulnerability details are available from the Wordfence Vulnerability Report.

Workarounds

• Disable the tips feature entirely through the Bookly plugin settings until a patch can be applied
• Implement a custom WAF rule to reject any requests where the tips parameter contains a negative value
• Add server-side validation at the web server level to sanitize numeric input parameters before they reach WordPress

# Example WAF rule for ModSecurity to block negative tips parameter
SecRule ARGS:tips "@lt 0" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Blocked negative tips parameter - CVE-2026-2519 mitigation'"