CVE-2026-93399: Bookly WordPress Plugin IDOR Vulnerability

CVE-2026-93399 Overview

The Bookly plugin for WordPress contains an Insecure Direct Object Reference (IDOR) vulnerability affecting all versions up to and including 28.2. The flaw exists in the bookly_get_form_id, bookly_render_complete, bookly_add_to_calendar, and bookly_rollback_order AJAX actions. Unauthenticated attackers can enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar and appointment information, and permanently delete arbitrary non-completed bookings. The weakness is tracked under [CWE-639: Authorization Bypass Through User-Controlled Key].

Critical Impact
Unauthenticated attackers can disclose customer order tokens and permanently delete arbitrary bookings on any WordPress site running Bookly ≤ 28.2.

Affected Products

Bookly plugin for WordPress, versions up to and including 28.2
WordPress sites using the bookly-responsive-appointment-booking-tool package
Any site exposing the vulnerable bookly_get_form_id, bookly_render_complete, bookly_add_to_calendar, or bookly_rollback_order AJAX endpoints

Discovery Timeline

2026-09-25 - CVE-2026-93399 published to NVD
2026-09-26 - Last updated in NVD database

Technical Details for CVE-2026-93399

Vulnerability Analysis

The vulnerability resides in Bookly's frontend booking workflow. The bookly_get_form_id AJAX handler accepts an attacker-controlled order_id field inside the submitted form_data and stores it directly into a new booking session without verifying ownership. The bookly_render_complete handler then trusts the session-stored order_id to look up and return the corresponding order's secret token. Because no check confirms that the current session actually created the referenced order, any unauthenticated client can supply arbitrary order identifiers.

Once an attacker obtains an order token, downstream endpoints such as bookly_add_to_calendar disclose calendar and appointment details for the victim's booking. The bookly_rollback_order endpoint goes further by permanently deleting non-completed bookings, cascading into the customer_appointment records and, when no other customers are attached, removing the underlying appointment entirely.

Root Cause

The root cause is missing authorization on object references. The bookly_get_form_id handler blindly persists a client-supplied order_id into server-side session state, and later handlers treat that session value as trusted authority. There is no session-to-order ownership check and no cryptographic binding between the booking session and the order it references.

Attack Vector

The attack is executed over the network against the WordPress admin-ajax.php endpoint. No authentication or user interaction is required. An attacker iterates sequential integer order_id values, submits them through bookly_get_form_id, and then calls bookly_render_complete to retrieve the matching order secret token. With that token, the attacker enumerates appointment data through bookly_add_to_calendar or destroys records via bookly_rollback_order.

// No verified public exploit code is available.
// See the Wordfence advisory and WordPress plugin source references for
// the vulnerable call sites in frontend/modules/booking/Ajax.php (lines 46,
// 733, and 1111) and frontend/modules/payment/Ajax.php (line 74).

Detection Methods for CVE-2026-93399

Indicators of Compromise

Repeated unauthenticated POST requests to admin-ajax.php with action=bookly_get_form_id and incrementing order_id values in form_data.
Sequential calls pairing bookly_get_form_id with bookly_render_complete from the same client IP within short time windows.
Unexpected invocations of bookly_rollback_order resulting in sudden disappearance of customer_appointment or appointment rows.
Access patterns to bookly_add_to_calendar for order IDs the originating session never created.

Detection Strategies

Inspect web server and WordPress access logs for high-frequency AJAX requests targeting the four affected Bookly actions from a single source.
Correlate booking database deletions against the originating session identifier and client IP to identify ownership mismatches.
Alert on any unauthenticated request to bookly_rollback_order, which should be rare in normal customer flows.

Monitoring Recommendations

Enable WordPress plugin audit logging to capture AJAX action names, parameters, and response sizes for Bookly endpoints.
Monitor appointment and order tables for unexpected row deletions and shrinking counts outside business hours.
Deploy a Web Application Firewall rule to flag enumeration patterns against bookly_get_form_id and bookly_render_complete.

How to Mitigate CVE-2026-93399

Immediate Actions Required

Update the Bookly plugin to a version later than 28.2 that includes the fix from WordPress Changeset Revision 3707284.
Audit booking and appointment tables for unauthorized deletions since the plugin was installed.
Rotate any customer-facing order tokens that may have been disclosed.

Patch Information

The vendor has published a fix in the Bookly plugin trunk; see the Wordfence Vulnerability Analysis CVE and the plugin source references including WordPress Ajax Module Line 1111 and WordPress User Booking Data Line 360 for the affected code paths.

Workarounds

Restrict access to admin-ajax.php for the vulnerable Bookly actions using a Web Application Firewall until the plugin is upgraded.
Temporarily disable the Bookly plugin on internet-facing sites that cannot be patched immediately.
Rate-limit unauthenticated POST requests to admin-ajax.php to slow enumeration of sequential order_id values.

bash

# Example WAF rule concept to block unauthenticated enumeration of Bookly AJAX actions
# (adapt to your WAF syntax; this is illustrative, not production-ready)
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1026933991,msg:'Block Bookly IDOR CVE-2026-93399'"
SecRule ARGS:action "@rx ^(bookly_get_form_id|bookly_render_complete|bookly_add_to_calendar|bookly_rollback_order)$"