CVE-2026-104898 in Bookly Plugin
Summary
by MITRE • 10/10/2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Online Scheduling and Appointment Booking System known as Bookly for WordPress represents a critical failure in access control mechanisms, specifically categorized under CWE-639: Insecure Direct Object Reference. This flaw exists within all versions of the plugin up to and including version 28.4. The core technical issue stems from insufficient validation on user-controlled input parameters, namely 'id' and 'wp_user_id', which are used to manage the association between WordPress users and Bookly staff records. In a secure implementation, any request that modifies sensitive associations or permissions must verify that the authenticated user has explicit authorization to perform actions on the specific resource being targeted. However, in this vulnerable configuration, the system fails to enforce these checks, allowing an attacker to manipulate object references directly without proper permission verification.
The operational impact of this vulnerability is severe, as it enables privilege escalation for attackers who possess at least subscriber-level access within the WordPress environment. By exploiting the missing validation on the 'id' and 'wp_user_id' parameters, an authenticated attacker can overwrite the WordPress account binding associated with any Bookly staff record. This capability extends to records owned by administrators, effectively allowing a lower-privileged user to hijack the account association of a higher-privileged staff member. Once this association is altered, the attacker gains control over the administrative or high-level staff functions tied to that profile, bypassing intended security boundaries and potentially gaining unauthorized access to sensitive scheduling data, customer information, and system configurations.
Exploitation of this vulnerability requires specific preconditions related to the plugin's configuration state. The attack vector becomes viable when an administrator has enabled the bookly_gen_allow_staff_edit_profile option, which is active by default on fresh installations of the software. Additionally, the attacker must be linked to at least one Bookly staff record, a condition that occurs naturally if any WordPress user has been associated with a staff entry. This combination of default settings and insufficient access control creates a widespread risk profile for sites running this plugin version range without additional hardening measures. The vulnerability aligns with MITRE ATT&CK techniques related to privilege escalation and account manipulation, highlighting the need for strict enforcement of role-based access controls in web applications handling user identity data.
To mitigate this vulnerability, administrators should immediately update the Bookly plugin to a patched version where these direct object reference checks have been implemented. Until an official patch is available or if updating is not feasible due to compatibility constraints, it is critical to disable the bookly_gen_allow_staff_edit_profile option through the WordPress admin dashboard. This action removes the ability for staff members to edit their own profile bindings via the vulnerable endpoint, thereby neutralizing the attack vector. Furthermore, organizations should review user roles and ensure that only trusted users are assigned staff records within Bookly. Implementing additional server-side validation or using a Web Application Firewall with rules targeting suspicious parameter manipulation on these specific endpoints can provide an extra layer of defense against exploitation attempts. Regular security audits and adherence to secure coding standards such as those outlined in the OWASP Top 10 will help prevent similar insecure direct object reference flaws in future development cycles.