CVE-2026-12626 in Bookly Plugin
Summary
by MITRE • 10/10/2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in the Online Scheduling and Appointment Booking System plugin, commonly known as Bookly, represents a critical security flaw within its WordPress integration architecture. Specifically, this issue manifests as a PHP Object Injection vulnerability affecting all versions up to and including 28.2. The root cause lies in the improper handling of user-supplied data during the deserialization process. When the application processes input via the 'value' parameter, it fails to adequately validate or sanitize the content before passing it to PHP's unserialize function. This architectural oversight allows an attacker who has successfully authenticated and possesses custom-level access privileges or higher to manipulate the internal state of the application by injecting malicious serialized objects into the execution context.
From a technical perspective, this flaw is classified under CWE-502, which denotes Deserialization of Untrusted Data. The vulnerability arises because the plugin accepts external input that directly influences object instantiation without sufficient checks on the type or origin of the data. In PHP environments, deserializing untrusted data can lead to arbitrary code execution if a suitable gadget chain is available within the application's dependencies or core libraries. A gadget chain consists of a sequence of existing classes and methods whose combined behavior results in the desired malicious outcome, such as executing system commands or accessing sensitive files. However, it is important to note that for this specific vulnerability instance, no known public exploit code utilizing a functional gadget chain has been disclosed. This absence does not negate the severity of the flaw but rather indicates that while the vector exists, immediate exploitation requires either custom-developed payloads targeting specific installed plugins or reliance on future discoveries of compatible gadgets within the WordPress ecosystem.
The operational impact of this vulnerability is significant due to the privilege level required for exploitation. Since authenticated attackers with at least custom-level access are needed, it targets users who have been granted elevated permissions within the booking system. While this restricts the attack surface compared to unauthenticated vulnerabilities, it remains a serious threat because insider threats or compromised administrative accounts can leverage this flaw. If an attacker successfully injects a PHP object that triggers a dangerous function through a discovered gadget chain, they could potentially achieve remote code execution on the web server hosting the WordPress instance. This would allow them to take full control of the website, steal sensitive customer data stored in the database, deface the site, or use the compromised server as a pivot point for further attacks against internal networks. The lack of a known gadget chain currently acts as a mitigating factor by raising the barrier to entry for attackers who do not have deep knowledge of the specific PHP environment and installed libraries.
To mitigate this risk, immediate action is required from system administrators and developers managing WordPress installations using Bookly. The primary recommendation is to upgrade the plugin to a version released after 28.2 where the deserialization issue has been patched by implementing strict input validation or replacing unsafe serialization practices with safer alternatives such as JSON encoding for data exchange. Until an update is applied, organizations should enforce rigorous access control policies, ensuring that only trusted individuals hold custom-level or higher privileges within the booking system. Additionally, deploying a Web Application Firewall can help detect and block anomalous requests containing serialized PHP objects in the value parameter. Security teams should also monitor server logs for unusual activity indicative of exploitation attempts and ensure that all WordPress core components and other plugins are updated to their latest secure versions to minimize the availability of potential gadget chains within the environment.