WordPress Plugin Vulnerabilities

Online Scheduling and Appointment Booking System – Bookly < 28.3 - Authenticated (Subscriber+) Insecure Direct Object Reference

Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.2. This is due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
bookly-responsive-appointment-booking-tool
Fixed in 28.3

References

CVE
CVE-2026-96347
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/b221a1f4-bd2f-47a6-bbd4-be41e0cb9e1f

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
3e0895b8-f6e0-4a25-9c8c-a3c868fd3324

Timeline

Publicly Published
2026-09-24 (about 23 days ago)
Added
2026-09-30 (about 16 days ago)
Last Updated
2026-09-30 (about 16 days ago)

Other

Published
Title
Published
2024-04-22
Title
Rate My Post – Star Rating Plugin by FeedbackWP < 3.4.5 - Insecure Direct Object Reference
Published
2025-11-10
Title
The Total Book Project < 1.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Published
2026-09-30
Title
Flexible PDF Coupons – Gift Cards & Vouchers for WooCommerce < 1.14.12 - Authenticated (Contributor+) Insecure Direct Object Reference
Published
2026-07-16
Title
wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR
Published
2025-01-10
Title
Unlimited Theme Addon For Elementor and WooCommerce < 1.2.3 - Authenticated (Contributor+) Post Disclosure