CVE-2026-2520 in Bookly Plugin
Summary
by MITRE • 09/08/2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/08/2026
The vulnerability identified within the Bookly Online Scheduling and Appointment Booking System for WordPress represents a critical failure in access control mechanisms, specifically categorized under CWE-284 Improper Access Control. This flaw resides in the updateAddon function of the plugin's codebase across all versions up to 27.2. The core technical issue is the absence of a proper capability check before executing administrative actions that modify system state. In WordPress architecture, functions that alter data or settings should verify that the requesting user possesses specific administrator-level privileges. However, in this instance, the function fails to enforce such restrictions, allowing users with significantly lower privilege levels, specifically those holding Subscriber access and above, to execute operations intended exclusively for site administrators.
From an operational perspective, this vulnerability enables authenticated attackers who have obtained valid credentials at any level from Subscriber upwards to perform unauthorized modifications to the plugin's configuration or state. The specific impact described involves the ability to update a plugin by specifying main.php as the target file, effectively allowing the attacker to force an update to its latest version against the site administrator's intent. While this may appear benign on the surface, it introduces significant risk regarding supply chain integrity and system stability. An attacker could potentially trigger updates at inopportune times, causing downtime or introducing new vulnerabilities if a newer version contains undiscovered flaws. Furthermore, such unauthorized actions can disrupt scheduled appointments and client data managed by the booking system, leading to business disruption and loss of trust among users relying on the scheduling service.
This type of vulnerability is frequently associated with insecure direct object references or broken access control patterns often seen in web applications that do not strictly enforce role-based access controls. It aligns with ATT&CK technique T1078 Valid Accounts, as it requires initial authentication but then exploits weak authorization logic to perform actions beyond the user's assigned role. The lack of verification allows a low-privileged account to escalate its effective privileges by manipulating administrative functions, which is a classic example of privilege escalation through improper access control rather than traditional exploitation of memory corruption or injection flaws.
Mitigation strategies for this vulnerability primarily involve immediate patching to version 27.3 or later where the capability checks have been properly implemented. Site administrators should verify that all instances of Bookly are updated and review user accounts to ensure no unauthorized users with elevated privileges exist within the WordPress environment. Additionally, implementing strict role-based access control policies at the server level can provide an additional layer of defense. Security monitoring tools should be configured to detect unusual administrative actions performed by low-privileged users, such as unexpected plugin updates or configuration changes, which could indicate exploitation attempts. Regular audits of custom code and third-party plugins for proper capability checks are essential to prevent similar access control failures in the future.