CVE-2026-93399 Information disclosure in Online Scheduling and Appointment Booking System – Bookly
Unauthenticated attackers can disclose booking tokens and delete arbitrary appointments via insecure direct object reference in the Bookly WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-93399?
CVE-2026-93399 is a critical vulnerability in ladela Online Scheduling and Appointment Booking System – Bookly, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
Weakness: CWE-639
Which versions are affected by CVE-2026-93399?
How do I fix CVE-2026-93399?
No fix has been published for CVE-2026-93399 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-93399 being exploited?
There is no known exploitation of CVE-2026-93399 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-rmc5-xv4j-mvf8.