CVE-2026-86838 Overview
CVE-2026-86838 affects the Bookly WordPress plugin in versions before 28.3. The plugin trusts client-supplied booking quantity values when computing the appointment total server-side. Unauthenticated attackers can submit manipulated quantity values to drive the appointment total to zero. A zero total bypasses the payment step entirely, letting attackers book paid services for free. The flaw is classified under CWE-472: External Control of Assumed-Immutable Web Parameter.
Critical Impact
Unauthenticated attackers can book paid services at no cost by tampering with booking quantity parameters, resulting in revenue loss for site operators relying on Bookly for appointment and service sales.
Affected Products
- Bookly WordPress plugin versions prior to 28.3
- WordPress sites offering paid appointments or services through Bookly
- E-commerce and service-booking workflows that depend on Bookly's price calculation
Discovery Timeline
- 2026-09-28 - CVE-2026-86838 published to the National Vulnerability Database
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-86838
Vulnerability Analysis
The Bookly plugin exposes a booking endpoint that accepts quantity values from the client as part of the appointment submission flow. The server reuses the submitted quantity when calculating the appointment total instead of recomputing it from trusted service pricing data. An attacker who intercepts or crafts the booking request can supply a quantity value that forces the computed total to zero.
When the total resolves to zero, the plugin treats the booking as fully paid and skips the payment gateway step. The booking is created as a confirmed, paid appointment without any charge against the attacker. No authentication is required to reach the vulnerable endpoint, which widens the exposure to any visitor of the WordPress site.
See the WPScan Vulnerability Report for additional details.
Root Cause
The root cause is improper trust in a client-controlled parameter. Price-affecting inputs such as booking quantity must be validated and recomputed on the server using authoritative pricing records. Bookly instead treats the quantity as assumed-immutable after it arrives from the browser, which maps directly to [CWE-472].
Attack Vector
Exploitation is network-reachable, requires no authentication, and no user interaction. An attacker submits a crafted booking request to the Bookly endpoint with a tampered quantity value. The server computes a zero total, bypasses payment processing, and confirms the appointment.
No verified public proof-of-concept code is published. The WPScan Vulnerability Report is the primary technical reference for the issue.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86838
Indicators of Compromise
- Confirmed bookings in the Bookly admin that have a total of 0 for services whose list price is non-zero.
- Appointments marked as paid without a matching transaction entry in the configured payment gateway.
- Repeated POST requests to Bookly AJAX booking endpoints from the same IP address with abnormal numeric parameters.
- Spikes in new unauthenticated bookings outside normal business hours.
Detection Strategies
- Reconcile Bookly booking totals against payment gateway transactions on a scheduled basis and flag mismatches.
- Inspect web server logs for admin-ajax.php or Bookly REST calls containing suspicious quantity or price-related parameters.
- Add web application firewall rules that reject booking submissions with non-standard numeric quantity values (negative, zero, or extreme).
Monitoring Recommendations
- Alert on any Bookly appointment created with a total of zero for a priced service.
- Monitor WordPress plugin inventory for Bookly installations still running a version below 28.3.
- Track outbound confirmation emails for free bookings to catch exploitation attempts in near real time.
How to Mitigate CVE-2026-86838
Immediate Actions Required
- Upgrade the Bookly WordPress plugin to version 28.3 or later on all affected sites.
- Audit existing bookings created before the upgrade and cancel any confirmed-paid appointments with a zero total.
- Review payment gateway reports for the exposure window and reconcile against the Bookly booking list.
Patch Information
The vendor addressed the issue in Bookly 28.3 by validating booking quantity values on the server before computing the appointment total. Operators should apply the update through the WordPress plugin manager or by deploying the updated plugin files. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Temporarily disable the Bookly plugin on public-facing sites until the patch can be applied.
- Restrict access to the Bookly booking endpoints with a web application firewall rule that validates quantity values server-side.
- Require manual admin approval for new bookings so that zero-total submissions are reviewed before fulfillment.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
