CVE-2026-96348 in Bookly Plugin
Summary
by MITRE • 09/30/2026
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an unbroken access control issue within Bookly versions prior to or equal to 28.2 represents a critical failure in the application's authentication and authorization mechanisms. This flaw allows attackers who have not authenticated themselves to interact with protected endpoints, effectively bypassing security controls that are intended to restrict functionality to authorized users only. In web applications like Bookly, which manage appointment scheduling and customer data, such access control failures can lead to severe consequences including unauthorized modification of schedules, exposure of sensitive personal information, or complete compromise of the underlying system if combined with other vulnerabilities.
From a technical perspective, this vulnerability typically stems from improper validation of user permissions on server-side endpoints. When an unauthenticated request is made to specific API routes or administrative pages within the Bookly plugin, the application fails to verify whether the requester possesses valid credentials or appropriate roles before processing the action. This oversight means that any individual with knowledge of the affected endpoint URLs can execute actions such as creating, updating, or deleting appointments and customer records without providing a username or password. The root cause often involves missing checks for session validity or role-based access control (RBAC) implementation gaps in the code handling these specific requests.
The operational impact of this vulnerability is significant due to the nature of appointment booking software which handles sensitive client data including names, contact details, and potentially payment information if integrated with e-commerce platforms. An attacker could exploit this flaw to disrupt business operations by canceling legitimate appointments or flooding the system with fake bookings. Furthermore, they could extract confidential customer lists for use in phishing campaigns or identity theft. In environments where Bookly is used as part of a larger enterprise resource planning ecosystem, this breach can serve as an entry point for further lateral movement within the network if additional security layers are not present.
This vulnerability aligns with CWE-284 Improper Access Control and falls under MITRE ATT&CK technique T1078 Valid Accounts when considering how attackers might leverage discovered credentials or bypass authentication entirely to gain unauthorized access. It also relates to CWE-639 Authorization Bypass Through User-Controlled Key if the vulnerability involves manipulating identifiers to access resources belonging to other users. The lack of proper enforcement allows for automated exploitation tools that can systematically probe these endpoints, making it a high-risk issue requiring immediate attention from system administrators and developers responsible for maintaining WordPress sites using this plugin.
Mitigation strategies primarily involve upgrading Bookly to version 28.3 or later where the access control logic has been corrected to properly enforce authentication requirements on all sensitive operations. Until an upgrade is feasible, temporary mitigations include restricting access to administrative areas via IP whitelisting if possible and ensuring that web application firewalls are configured to block requests lacking valid session tokens for protected endpoints. Regular security audits and penetration testing should be conducted to identify similar weaknesses in other plugins or custom code integrated with the booking system. Additionally, implementing strict input validation and output encoding can help reduce the attack surface associated with such vulnerabilities by preventing potential secondary attacks like SQL injection that might exploit poorly secured data handling practices linked to these access control failures.