All vulnerabilities
CVE-2026-86839

Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

Unknown Online Scheduling and Appointment Booking System
Open in ThreatlineRecord JSON
CVSS
3.8Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.3Fixed versionCVE List
Published27 Sep 2026Updated 28 Sep 2026CVE List

What fixes it

  • 28.3Online Scheduling and Appointment Booking SystemCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.

Text from CVE List

Affected versions 1

  • Online Scheduling and Appointment Booking Systemaffected: all versions before 28.3CVE List

References 1