CVE-2026-103365 in Bookly Plugin
Summary
by MITRE • 10/10/2026
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint bookly_render_details is registered for both wp_ajax and wp_ajax_nopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {client_name}, {client_email}, {client_phone}, or {client_note} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Bookly versions up to 28.4 represents a critical failure in access control and input validation within the WordPress plugin ecosystem, specifically affecting the classic booking form workflow. The core of this issue lies in the configuration of the AJAX endpoint bookly_render_details, which is registered for both authenticated users via wp_ajax and unauthenticated visitors via wp_ajax_nopriv. This dual registration allows external actors to interact with sensitive backend logic without requiring any prior authentication credentials or session tokens. Furthermore, the plugin explicitly overrides the csrfTokenValid() method to always return true, effectively disabling Cross-Site Request Forgery protections that would otherwise mitigate such unauthorized API calls. This combination of an unauthenticated endpoint and disabled CSRF validation creates a direct attack vector for remote exploitation by individuals with no legitimate access rights to the system.
The technical flaw centers on how customer data is retrieved and processed during the booking details phase. When the bookly_render_details endpoint is invoked, it triggers the Bookly\Frontend\Components\Booking\InfoText::getCodes() function, which in turn calls UserBookingData::getCustomer(). This retrieval mechanism relies exclusively on a user-supplied phone number or email address as the primary key to locate and load the corresponding Customer entity from the database. Crucially, this process bypasses the plugin's internal customerIdentityConfirmed() predicate, which is designed to verify that the requesting party has legitimately confirmed their identity before accessing sensitive information. By skipping this verification step, the application fails to ensure that the person making the request is actually the owner of the provided contact details or an authorized administrator. This lack of ownership validation allows any individual who knows a registered customer's phone number or email address to trigger data retrieval operations for that specific user profile.
The operational impact of this vulnerability is significant, leading directly to sensitive information exposure as defined by industry standards such as CWE-200 and CWE-359. When the site administrator has configured the Details step appearance to include placeholders like {client_name}, {client_email}, {client_phone}, or {client_note}, these fields are dynamically populated with data from the retrieved Customer entity before being returned in the HTML response sent back to the attacker. Consequently, an unauthenticated adversary can extract personally identifiable information including full names, email addresses, phone numbers, and any internal notes stored by administrators about that customer. This exposure violates fundamental privacy principles and data protection regulations such as GDPR or CCPA, potentially resulting in legal liabilities for site owners while also facilitating further social engineering attacks against the exposed individuals using their verified personal details.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to Collection via Unsecured APIs and Information Gathering through Web Services. The attacker leverages standard web protocols to enumerate valid user records and extract structured data without triggering typical security alerts associated with brute-force or injection attacks. To mitigate this risk, immediate action is required by updating the Bookly plugin to a version where these access controls have been corrected. In the interim, site administrators should consider restricting access to WordPress AJAX endpoints through web application firewall rules that require valid nonces for sensitive operations. Additionally, reviewing server logs for unusual patterns of requests targeting the bookly_render_details endpoint can help identify ongoing exploitation attempts. Ensuring that customer identity verification is strictly enforced before any personal data is rendered or transmitted remains essential for maintaining the integrity and confidentiality of user information within booking systems.