CVE-2026-92799: Bookly WordPress Plugin Auth Bypass Flaw

CVE-2026-92799 Overview

CVE-2026-92799 is an authorization bypass vulnerability in the Bookly plugin for WordPress, affecting all versions up to and including 28.2. The flaw resides in the postValidateCustomer() function, which uses a loose PHP inequality operator (!=) to compare a session-stored one-time verification code against attacker-supplied input. Unauthenticated attackers can submit a JSON boolean true as the verification_code to bypass phone and email ownership verification. Successful exploitation allows overwriting the name, email, phone, and address fields of any existing Bookly customer record. This vulnerability is categorized under [CWE-285] Improper Authorization.

Critical Impact
Unauthenticated attackers can redirect any Bookly customer's booking notifications to attacker-controlled contact details by overwriting their stored record.

Affected Products

Bookly – Online Scheduling and Appointment Booking System plugin for WordPress
All versions up to and including 28.2
WordPress sites exposing the booking AJAX endpoint to unauthenticated users

Discovery Timeline

2026-09-25 - CVE-2026-92799 published to the National Vulnerability Database
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-92799

Vulnerability Analysis

The vulnerability stems from PHP type juggling behavior combined with insufficient input normalization. The postValidateCustomer() function in the booking AJAX controller compares a six-digit session code (generated by mt_rand(100000, 999999)) against user-supplied input using the loose != operator. When PHP compares a boolean true against a non-zero integer, the loose comparison evaluates to equal, causing the guard clause true != <non-zero int> to resolve as false and permitting the request to proceed.

The booking controller compounds the risk by registering all methods as wp_ajax_nopriv_ handlers, exposing them to unauthenticated callers. The controller also unconditionally overrides csrfTokenValid() to return true, removing cross-site request forgery protection from the endpoint. Together these conditions turn a type-juggling bug into a reliable, unauthenticated customer record takeover primitive.

Root Cause

Two design decisions enable the bypass. First, postValidateCustomer() uses loose comparison instead of strict equality (!==) when validating the verification code. Second, the json_data input channel parses the request body with json_decode(), which preserves native PHP types rather than coercing everything to strings. The sanitization layer applies wp_kses, which only operates on strings and silently leaves non-string scalar values such as true untouched.

Attack Vector

An unauthenticated attacker submits a crafted POST request to the Bookly booking AJAX endpoint with json_data containing a verification_code field set to the JSON literal true. Because the session-generated code is always a non-zero integer in the range 100000 to 999999, the loose comparison always succeeds. The attacker specifies the target customer's identifier along with replacement name, email, phone, and address values, which Bookly writes to the stored customer record. Subsequent booking notifications and confirmations route to the attacker-controlled contacts.

For technical references, see the Wordfence Vulnerability Report and the vulnerable Ajax.php source at line 1447.

Detection Methods for CVE-2026-92799

Indicators of Compromise

POST requests to admin-ajax.php with action=bookly_pro-... or Bookly booking actions where the json_data payload contains a boolean verification_code value.
Unexpected modifications to Bookly customer records in the wp_bookly_customers table, especially bulk changes to email, phone, full_name, or address columns.
Booking confirmation emails or SMS notifications routed to domains or numbers not previously associated with the customer.

Detection Strategies

Inspect raw request bodies for admin-ajax.php traffic and flag payloads where verification_code is a JSON boolean rather than a string or integer.
Audit the wp_bookly_customers table and plugin audit logs for contact-field updates not preceded by a successful verification SMS or email event.
Correlate unauthenticated AJAX activity volume with changes to customer records to surface automated enumeration.

Monitoring Recommendations

Enable WordPress plugin and database change logging to capture Bookly customer record writes with before/after values.
Alert on repeated requests to Bookly booking endpoints from a single source IP targeting multiple distinct customer identifiers.
Monitor outbound notification channels (SMTP relays, SMS gateways) for sudden shifts in recipient domains tied to booking workflows.

How to Mitigate CVE-2026-92799

Immediate Actions Required

Update the Bookly plugin to a version later than 28.2 that contains the vendor fix referenced in the WordPress plugin changeset.
Review Bookly customer records modified since the plugin was first installed and restore any entries with suspicious contact details from backups.
Rotate any shared credentials or API keys that may have been exposed through intercepted booking notifications.

Patch Information

The vendor committed a fix in revision 3707284 of the bookly-responsive-appointment-booking-tool repository. Site administrators should upgrade through the WordPress plugin updater or by replacing plugin files with the patched release. The fix addresses the loose comparison in postValidateCustomer() and tightens handling of the json_data input channel.

Workarounds

Place the Bookly booking AJAX endpoint behind a web application firewall rule that rejects requests where verification_code is a JSON boolean or non-numeric value.
Temporarily disable the Bookly plugin on sites that cannot immediately upgrade, especially on high-value tenants with sensitive customer data.
Restrict access to admin-ajax.php from untrusted networks where business requirements allow.

bash

# Example ModSecurity rule to block boolean verification_code payloads
SecRule ARGS:json_data "@rx \"verification_code\"\s*:\s*(true|false)" \
  "id:1092799,phase:2,deny,status:403,log,\
   msg:'CVE-2026-92799 Bookly type juggling bypass attempt'"