Security Alert Summary
The Bookly WordPress plugin before 28.3 does not properly verify a customers identity before updating their stored details. An unauthenticated attacker who knows a customers primary identifier can overwrite that customers stored personal information, including name, email, and address.
CVE Details
- CVE ID:
CVE-2026-86837 - Affected component: Bookly WordPress plugin
- Affected versions: versions before 28.3
- Published: September 25, 2026 at 9:17:06 AM UTC
- Last modified: September 25, 2026 at 1:25:16 PM UTC
- CVSS v3.1: Base score 5.3, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Attack characteristics: Network (AV:N), Low complexity (AC:L), Privileges required: None (PR:N), User interaction: None (UI:N), Scope: Unchanged (S:U)
- Authentication / Privileges / User interaction: No authentication required; no privileges required; no user interaction required
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- CWE / weakness: CWE-639
Technical Details
The plugin fails to verify a customers identity before processing updates to stored customer details. Specifically, an attacker who knows a customers primary identifier can submit updates that overwrite that customers stored personal information such as name, email, and address. The underlying issue is a missing or insufficient identity verification step in the update flow for customer data.
No specific functions or REST API endpoints are named in the available description. The reported weakness is a verification/control failure that allows unauthorized modification of stored records rather than disclosure of data.
Impact is limited to modification of data (integrity). An attacker can alter a customers contact details, which may disrupt communications or cause incorrect records to be stored, but the information is not reported as being exposed by this vulnerability.
How This Could Impact Your Website
Consider a site with multiple WordPress users: a site owner who manages plugins, internal staff who handle bookings and customer records, and external contractors who occasionally assist with content or support. If the Bookly plugin on that site is vulnerable, an unauthenticated actor who knows a customers identifier could overwrite that customers stored name, email, or address.
- Internal communications can be disrupted if customer contact details are changed, leading to missed or misdirected messages.
- Attackers could replace email addresses with attacker-controlled addresses, increasing the risk of targeted phishing or social engineering against staff or customers.
- Incorrect customer records can interfere with support, billing, or scheduling processes and require manual correction by staff.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts and other roles with update permissions.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and customer record changes for unusual behavior or unexpected modifications.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
