Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.8
CVE-2026-86839: Bookly plugin lets staff view and change others' appointments
CVE-2026-86839 · published 22 days ago
Summary
The Bookly scheduling plugin for WordPress does not check that a staff member’s request matches their own appointments or payments. A staff‑level user can see, edit, or delete other staff members’ bookings and payment details, exposing customers' personal information. Limit staff access to trusted users or update to the latest version that adds proper ownership checks.
What to do
- Update unknown online scheduling and appointment booking system to version 28.3 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | online scheduling and appointment booking system | < 28.3 |
Original advisory text
Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a staff-level account to view, modify and delete other staff members' appointments and payments, including the associated customer's personal information.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
3.8
Low
Type
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published27 Sep 2026
Updated15 Oct 2026
First seen27 Sep 2026
Track software like this
Free during beta