{"schema":"threatline.record/2","record":{"id":"CVE-2026-92799","aliases":[],"summary":"Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data","details":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the `postValidateCustomer()` function using a loose PHP inequality operator (`!=`) to compare the session-stored one-time verification code against the attacker-supplied `verification_code` parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as `wp_ajax_nopriv_` handlers and unconditionally overriding `csrfTokenValid()` to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the `json_data` input channel decodes input via `json_decode()`, which preserves real PHP types and causes the `wp_kses` filter to leave non-string values such as the JSON boolean `true` untouched; submitting `true` as the `verification_code` satisfies the loose comparison against the session's non-zero integer code (generated by `mt_rand(100000, 999999)`), causing `true != <non-zero int>` to evaluate as `false` and the guard to be bypassed.","categories":["Unclassified"],"product":"Online Scheduling and Appointment Booking System – Bookly","vendor":"ladela","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92799","source_modified_at":"2026-09-25T10:37:28.171Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"Online Scheduling and Appointment Booking System – Bookly","vendor":"ladela","versions":[{"version":"0","status":"affected","lessThanOrEqual":"28.2","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00315,"percentile":0.23178,"score_date":"2026-10-23"},"published_at":"2026-09-25T06:39:55.585Z","modified_at":"2026-09-25T10:37:28.171Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92799","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-25T10:37:28.171Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92799","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d24fa600-7698-4081-92f5-e11606928886?source=cve"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/Validator.php#L276"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/base/Component.php#L182"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L785"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L903"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/lib/UserBookingData.php#L638"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L1447"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L15"},{"source":"CVE List","url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3707284%40bookly-responsive-appointment-booking-tool&new=3707284%40bookly-responsive-appointment-booking-tool"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-25T10:35:41.040639Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-25T10:37:28.171Z","content_hash":"a64251676c441ac01b9addd76e489b09e8fc77840de57b043a8298baa7d9e916"}}