WordPress Plugin Vulnerabilities

Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation

Description

The plugin does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

Proof of Concept

Affects Plugins

Plugin icon
bookly-responsive-appointment-booking-tool
Fixed in 28.3

References

CVE
CVE-2026-86838

Miscellaneous

Original Researcher
vuxvinh
Submitter
vuxvinh
Verified
Yes
WPVDB ID
1c8a53e7-5556-4dcb-a461-c6df253d0b7a

Timeline

Publicly Published
2026-09-25 (about 2 days ago)
Added
2026-09-25 (about 2 days ago)
Last Updated
2026-09-25 (about 2 days ago)

Other

Published
Title
Published
2026-09-02
Title
ePayco Payment Gateway for WooCommerce < 8.4.7 - Unauthenticated Payment Confirmation Bypass
Published
2018-08-26
Title
Ajax BootModal Login <= 1.4.3 - Captcha Reuse
Published
2025-08-21
Title
Wp Edit Password Protected < 1.3.5 - Protection Bypass via REST API
Published
2026-07-09
Title
WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass
Published
2020-02-25
Title
Flexible Checkout Fields for WooCommerce < 2.3.2 - Unauthenticated Settings Update