CVE-2026-89063: Bookly Plugin Information Disclosure Flaw

CVE-2026-89063 Overview

CVE-2026-89063 is an Insecure Direct Object Reference (IDOR) vulnerability in the Bookly plugin for WordPress, an online scheduling and appointment booking system. The flaw affects all versions up to and including 28.1. It resides in the handling of the conversation_id parameter within the AI conversation endpoint, which lacks validation on a user-controlled key [CWE-639]. Unauthenticated attackers can read any customer's AI booking conversation transcript and inject arbitrary messages into victim conversations that are subsequently replayed to the Cloud AI worker with the full private history.

Critical Impact
Unauthenticated attackers can enumerate sequential conversation_id values to harvest customer names, email addresses, phone numbers, and appointment details from any AI booking conversation stored by the plugin.

Affected Products

Bookly – Online Scheduling and Appointment Booking System plugin for WordPress
All versions up to and including 28.1
WordPress sites exposing the Bookly AI conversation endpoint (frontend/modules/ai/Ajax.php)

Discovery Timeline

2026-09-16 - CVE-2026-89063 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-89063

Vulnerability Analysis

The Bookly plugin exposes an AJAX endpoint in frontend/modules/ai/Ajax.php that accepts a conversation_id parameter to load and update AI booking conversations. The endpoint does not verify that the requester owns the referenced conversation. AI conversations are stored without an owner, user, or session identifier, so there is no server-side binding between a browser session and a conversation record.

Because conversation_id values are sequential integers, an attacker can iterate the identifier space to retrieve every stored transcript. The same endpoint accepts inbound messages tied to an arbitrary conversation_id, allowing an attacker to append messages to any victim conversation. Those injected messages are then replayed to the Cloud AI worker together with the full private history, extending the impact from disclosure to prompt-level manipulation of the assistant's context.

Root Cause

The root cause is missing authorization on a user-controlled key, mapped to [CWE-639] Authorization Bypass Through User-Controlled Key. The AJAX handler trusts the conversation_id supplied by the client and performs no ownership, capability, or session-binding check before returning or mutating the associated record.

Attack Vector

The endpoint is reachable over the network without authentication or user interaction. An attacker sends crafted AJAX requests to the WordPress admin-ajax.php endpoint targeting the Bookly AI action, incrementing conversation_id to enumerate transcripts or to post attacker-controlled messages into a target conversation. Successful exploitation yields personally identifiable information (PII) exfiltration and injection into AI conversation state used by downstream Cloud AI processing.

Code-level details for the vulnerable handler are available in the WordPress Plugin Code Line 212, Line 215, Line 38, and Line 60 references, along with the shared WordPress Plugin Component Line 67.

Detection Methods for CVE-2026-89063

Indicators of Compromise

Sequential or high-volume requests to wp-admin/admin-ajax.php referencing Bookly AI actions with incrementing conversation_id values.
Unauthenticated POST requests from a single source IP touching a wide range of conversation_id values in a short window.
AI conversation records containing messages whose metadata does not match the originating customer's prior session context.

Detection Strategies

Alert on unauthenticated access patterns to Bookly AI AJAX actions where the source enumerates numeric parameters.
Correlate WordPress access logs with plugin database rows to identify conversation reads without a matching legitimate booking session.
Deploy virtual patching or Web Application Firewall (WAF) rules that block requests to the vulnerable action when the caller lacks a valid session tied to the requested conversation_id.

Monitoring Recommendations

Ingest WordPress and reverse-proxy access logs into a centralized analytics platform and baseline normal request rates to admin-ajax.php Bookly actions.
Monitor outbound calls from the WordPress host to the Bookly Cloud AI worker for unusual message volume or content shape.
Track database growth in the Bookly AI conversation tables to detect scraping-driven anomalies.

How to Mitigate CVE-2026-89063

Immediate Actions Required

Update the Bookly plugin to a version later than 28.1 as soon as the vendor publishes a fixed release.
Restrict access to the Bookly AI AJAX action at the WAF or reverse proxy layer until the plugin is patched.
Rotate any customer-facing communications and notify affected users if log review confirms conversation enumeration.

Patch Information

At the time of publication, the NVD entry lists the vulnerable range as all versions up to and including 28.1. Refer to the Wordfence Vulnerability Report for the current fixed version and vendor advisory status before deploying an update.

Workarounds

Temporarily disable the Bookly AI conversation feature if the plugin cannot be updated immediately.
Deploy a WAF rule that blocks unauthenticated requests to the Bookly AI action or that enforces a session cookie bound to the requested conversation_id.
Review WordPress and application logs for prior enumeration of conversation_id values and preserve evidence for incident response.

bash

# Example WAF rule concept (ModSecurity-style) to block unauthenticated Bookly AI AJAX access
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026089063,msg:'Block unauthenticated Bookly AI conversation access (CVE-2026-89063)'"
  SecRule ARGS:action "@rx ^bookly_ai" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"