Security Alert Summary
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress contains a price manipulation vulnerability via the tips parameter. The plugin trusts user-supplied input without server-side validation against the configured price, allowing an unauthenticated attacker to submit a negative number for tips and reduce the total price to zero.
CVE Details
- CVE ID: CVE-2026-2519
- Affected component: Online Scheduling and Appointment Booking System – Bookly plugin for WordPress
- Affected versions: All versions up to, and including, 27.0
- Published: April 9, 2026 at 1:16:42 PM UTC
- Last modified: April 9, 2026 at 1:16:42 PM UTC
- CVSS v3.1: Base Score 5.3 (MEDIUM) — Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User Interaction: Privileges Required: None; User Interaction: None; Authentication: None (unauthenticated access possible)
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE: CWE-472
Technical Details
The vulnerability is a failure to validate a user-supplied numeric input for the tips parameter on the booking/payment flow. The plugin does not verify the submitted value against the configured price on the server side, allowing a client to submit a negative value. When a negative tips value is accepted, the calculation of the booking total can be reduced to zero.
Code paths referenced in the disclosure include frontend/modules/booking/Ajax.php, lib/CartInfo.php, and lib/UserBookingData.php, which indicate the issue exists in the booking/cart handling and calculation logic where input is taken from requests and used in price computation without adequate server-side validation.
The practical impact is limited to manipulation of calculated prices or payment amounts; it does not indicate disclosure of sensitive data or remote code execution. The integrity of payment totals is reduced, meaning attackers can cause incorrect charges (including zero charges) for bookings if they can submit crafted requests.
How This Could Impact Your Website
Consider a small business running Bookly to accept appointments and payments. A site owner maintains the plugin and a staff member manages bookings. An external contractor or a visitor could submit crafted booking requests that include a negative tips value. Because the plugin accepts that value without server-side validation, a malicious actor could cause bookings to be processed with a zero total, resulting in lost revenue for individual appointments.
In this scenario, owners and staff may see unexpected free bookings in booking records and payment processors may show mismatched transactions. While this vulnerability affects payment calculation integrity rather than user data, any combination with other weaknesses (for example, unauthorized access to user lists) could increase the risk of targeted phishing or social engineering.
If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors and other accounts with booking or administrative access.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site and booking activity for unusual behavior, such as unexpected zero-value bookings or repeated anomalous requests.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/frontend/modules/booking/Ajax.php#L709
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/CartInfo.php#L450
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/UserBookingData.php#L355
- https://plugins.trac.wordpress.org/changeset/3480956/
- https://www.booking-wp-plugin.com/change-log/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ead87d8b-2659-4e8b-a0b9-138b1db89e36?source=cve
