CVE-2026-89063 in Bookly Plugin
Summary
by MITRE • 09/16/2026
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker along with the full private history. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations simply by incrementing the conversation_id parameter.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Online Scheduling and Appointment Booking System – Bookly plugin for WordPress represents a critical failure in access control mechanisms, specifically categorized as Insecure Direct Object Reference or Broken Access Control under CWE-639. This flaw exists within all versions of the plugin up to and including version 28.1 and is triggered through the manipulation of the conversation_id parameter. The core technical issue stems from a complete absence of server-side validation on this user-controlled input, allowing unauthenticated actors to interact directly with internal system resources without proper authorization checks or ownership verification.
The operational impact of this vulnerability is severe due to the nature of the data being exposed and manipulated. Because AI conversations are stored in the database without explicit owner identifiers, session tokens, or user association metadata, there is no mechanism for the application to distinguish between a legitimate request from an authorized customer and a malicious request from an external attacker. This architectural oversight means that any valid conversation ID can be accessed by anyone who knows it, leading to a total compromise of confidentiality for sensitive personal information. Attackers can extract full transcripts containing names, email addresses, phone numbers, and detailed appointment specifics, which constitutes a significant privacy violation and potential breach of data protection regulations such as GDPR or CCPA depending on the jurisdiction.
Furthermore, the vulnerability extends beyond passive data exfiltration to active integrity violations through message injection. An attacker is not limited to reading existing conversations but can also inject arbitrary messages into any victim's conversation thread. These injected messages are then processed by the Cloud AI worker alongside the complete private history of that user. This capability allows for sophisticated social engineering attacks, where an adversary could impersonate support staff or manipulate the AI assistant to provide incorrect information, schedule conflicting appointments, or extract sensitive data from the victim through deceptive dialogue. The sequential nature of conversation IDs exacerbates this risk by enabling efficient enumeration; attackers can systematically iterate through integer values to discover and compromise every customer interaction stored in the system without needing prior authentication credentials.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1078, Valid Accounts, although it is exploited via unauthenticated means due to the lack of access controls rather than stolen credentials. It also reflects CWE-209, which involves the generation of error messages that contain too much information, as well as CWE-352, Cross-Site Request Forgery if the endpoint can be triggered via browser-based requests without proper anti-CSRF tokens, though the primary vector here is direct API manipulation. The sequential ID pattern further highlights a failure in implementing opaque identifiers or randomization strategies for sensitive resources, which are standard best practices for preventing enumeration attacks.
Mitigation requires immediate action to address both the technical flaw and the underlying architectural design. Administrators should update the Bookly plugin to the latest version where this vulnerability has been patched by enforcing strict ownership validation on all API endpoints handling conversation data. Until an official patch is applied, temporary mitigations include restricting access to the relevant API endpoints via web application firewall rules that block unauthenticated requests to paths containing the vulnerable parameter. Additionally, implementing rate limiting can help mitigate enumeration attempts by slowing down rapid sequential ID probing. Long-term remediation should involve redesigning the conversation storage schema to explicitly link each record to a specific user account and session context, ensuring that access control checks are performed before any data retrieval or modification occurs.