CVE-2026-42667: Bookly Information Disclosure Flaw

CVE-2026-42667 Overview

CVE-2026-42667 is an unauthenticated sensitive data exposure vulnerability affecting the Bookly WordPress plugin in versions 27.4 and earlier. The flaw is classified under [CWE-201] (Insertion of Sensitive Information Into Sent Data) and allows remote attackers to retrieve protected information without authentication. Bookly is a widely deployed appointment booking plugin for WordPress, and exposed data can include customer-submitted booking details handled by the plugin. The vulnerability is network-exploitable, requires no privileges, and needs no user interaction, making it accessible to any remote attacker who can reach the target site.

Critical Impact
Remote, unauthenticated attackers can retrieve sensitive booking data from affected Bookly installations without credentials or user interaction.

Affected Products

Bookly WordPress plugin (Responsive Appointment Booking Tool)
Bookly versions 27.4 and earlier
WordPress sites running vulnerable Bookly installations

Discovery Timeline

2026-06-15 - CVE-2026-42667 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-42667

Vulnerability Analysis

The vulnerability allows unauthenticated users to access sensitive data managed by the Bookly plugin. The issue maps to [CWE-201], where information that should remain restricted is included in responses available to unauthorized requesters. Because Bookly handles appointment data such as customer names, contact information, scheduled times, and service details, exposure of this data has direct privacy implications. The advisory from Patchstack confirms the vulnerability affects all versions up to and including 27.4. Attackers can interact with the plugin's endpoints over standard HTTP/HTTPS without supplying authentication tokens or session cookies.

Root Cause

The root cause is missing authorization on functionality that returns sensitive plugin data. The plugin fails to validate whether the requesting user is permitted to receive the data before serving it in the response. This category of flaw typically arises when AJAX handlers or REST endpoints either omit capability checks (current_user_can()) or rely on nonces and identifiers that are guessable or absent for unauthenticated callers.

Attack Vector

Exploitation requires only network access to the target WordPress site. An attacker issues crafted HTTP requests to the vulnerable plugin endpoint and receives sensitive booking-related data in the response. No credentials, privileges, or victim interaction are needed. The confidentiality impact is high, while integrity and availability are not affected. Refer to the Patchstack Vulnerability Advisory for the technical breakdown.

Detection Methods for CVE-2026-42667

Indicators of Compromise

Unauthenticated HTTP requests to Bookly AJAX endpoints under /wp-admin/admin-ajax.php or /wp-json/ returning structured booking data.
Unusual volumes of GET or POST requests originating from a single source targeting Bookly action parameters.
Outbound transfers of booking records or customer contact data not associated with administrator sessions.

Detection Strategies

Inspect web server access logs for repeated requests to Bookly plugin endpoints lacking valid authentication cookies.
Deploy WordPress security plugins or a web application firewall (WAF) with rules covering Bookly information disclosure patterns.
Correlate plugin-version inventory with the affected range (≤ 27.4) to identify exposed sites.

Monitoring Recommendations

Enable verbose logging on WordPress AJAX and REST routes used by Bookly.
Alert on anomalous response sizes from admin-ajax.php requests tied to Bookly actions.
Monitor authentication context for all responses returning personally identifiable information.

How to Mitigate CVE-2026-42667

Immediate Actions Required

Update the Bookly plugin to a version newer than 27.4 as soon as a fixed release is available from the vendor.
Audit existing booking data exposure by reviewing server logs for prior unauthenticated requests to Bookly endpoints.
Restrict access to the WordPress site or Bookly endpoints via IP allowlisting where feasible until patched.

Patch Information

Refer to the Patchstack Vulnerability Advisory for the latest fixed version and remediation guidance from the Bookly vendor. Apply the vendor-supplied update through the WordPress plugin manager and verify the installed version exceeds 27.4 after upgrade.

Workarounds

Deploy a WAF rule blocking unauthenticated requests to Bookly AJAX and REST endpoints that return booking data.
Temporarily deactivate the Bookly plugin on sites that cannot be patched immediately.
Limit the scope of data stored within Bookly to reduce exposure until remediation is complete.

bash

# Example WAF rule pattern (ModSecurity) to block unauthenticated Bookly AJAX calls
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1042667,msg:'Block unauthenticated Bookly endpoint access'"
SecRule ARGS:action "@rx ^bookly_" \
  "chain"
SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"