CVE-2026-86837: Bookly WordPress Plugin Auth Bypass Vulnerability

CVE-2026-86837 Overview

CVE-2026-86837 affects the Bookly WordPress plugin in versions prior to 28.3. The plugin fails to verify a customer's identity before updating stored details. Unauthenticated attackers who know a customer's primary identifier can overwrite that customer's stored personal information, including name, email, and address. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key, commonly known as Insecure Direct Object Reference (IDOR).

Critical Impact

Remote, unauthenticated attackers can tamper with customer records stored in Bookly, enabling data integrity loss, account takeover preparation, and downstream fraud against booking workflows.

Affected Products

• Bookly WordPress plugin versions prior to 28.3
• WordPress sites running Bookly for appointment and booking management
• Any Bookly deployment that exposes customer records keyed by a guessable or discoverable identifier

Discovery Timeline

• 2026-09-25 - CVE-2026-86837 published to the National Vulnerability Database
• 2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-86837

Vulnerability Analysis

The Bookly plugin exposes a customer update code path that trusts a client-supplied identifier without validating that the requester owns the referenced record. The server accepts the update request, locates the customer by the supplied primary identifier, and writes the attacker-controlled values into the stored row. No session token, email confirmation, or ownership check gates the operation.

The flaw is a classic IDOR issue tracked as CWE-639. It affects data integrity rather than confidentiality or availability, which is reflected in the vector's C:N/I:L/A:N outcome. An attacker who can enumerate or guess a customer identifier can rewrite that customer's name, email address, and physical address at will.

The Exploit Prediction Scoring System currently reports an EPSS probability of 0.182% as of 2026-10-01. No public proof-of-concept exploit, CISA KEV entry, or Exploit-DB record is associated with this CVE at publication.

Root Cause

The root cause is a missing authorization check in the customer update handler. The plugin treats possession of a customer's primary identifier as sufficient proof of identity. It does not require a nonce bound to an authenticated session, a signed update token, or an out-of-band confirmation such as an email verification link.

Attack Vector

The attack is executed over the network with low complexity and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the vulnerable Bookly endpoint, supplies a known or enumerated customer identifier, and includes replacement values for name, email, and address fields. The server processes the request and persists the modified record. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-86837

Indicators of Compromise

• Unexpected modifications to customer records in Bookly database tables, particularly to email, full_name, and address columns
• Bookly notification emails sent to addresses that do not match the original customer-of-record
• Clusters of customer update requests from a single IP against sequential or enumerated customer identifiers
• Web server access logs showing POST or AJAX requests to Bookly customer update endpoints without an authenticated session cookie

Detection Strategies

• Audit Bookly customer tables for recent UPDATE operations and compare current values against backups to identify tampered fields
• Instrument WordPress with an activity log plugin that records plugin-level database writes and REST or admin-ajax calls
• Alert on repeated requests to Bookly AJAX actions from unauthenticated sessions targeting different customer IDs within a short window

Monitoring Recommendations

• Forward WordPress and web server logs to a centralized analytics tier for correlation across customer identifier enumeration patterns
• Track outbound email volume from the WordPress host for anomalous spikes tied to customer confirmation flows
• Monitor Bookly plugin version across managed WordPress sites and alert when any instance remains below 28.3

How to Mitigate CVE-2026-86837

Immediate Actions Required

• Upgrade the Bookly plugin to version 28.3 or later on every WordPress site in the estate
• Review Bookly customer records for unauthorized changes since deployment and restore from backup where tampering is confirmed
• Notify affected customers if their contact details were altered, and reverify email addresses before sending further booking communications
• Rotate any administrative credentials or API keys that may have been exposed through the compromised notification flow

Patch Information

The vendor fixed the issue in Bookly version 28.3. The patch adds the identity verification step missing from the vulnerable update path. Update through the WordPress plugin dashboard or by replacing the plugin directory with the patched release. See the WPScan Vulnerability Report for vendor references.

Workarounds

• Deactivate the Bookly plugin until the upgrade to 28.3 can be scheduled if customer data integrity cannot be assured
• Place the vulnerable AJAX and REST endpoints behind a web application firewall rule that blocks unauthenticated customer update requests
• Restrict access to the WordPress site to known IP ranges while the patch is staged for production rollout

# Configuration example: WP-CLI upgrade of Bookly to the patched release
wp plugin update bookly-responsive-appointment-booking-tool --version=28.3
wp plugin list --name=bookly-responsive-appointment-booking-tool --fields=name,status,version