CVE-2026-104898 Details
Description
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.
A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Bookly plugin for WordPress, specifically in the Online Scheduling and Appointment Booking System version 28.4 and prior. The issue arises from inadequate validation of user-controlled parameters, 'id' and 'wp_user_id'. This vulnerability enables authenticated attackers with subscriber-level access or higher to overwrite the WordPress account association of any Bookly staff record, including those belonging to administrators. As a result, an attacker could hijack the account of a higher-privileged staff member. Exploitation requires the attacker to be associated with at least one Bookly staff record, which is automatically the case when the 'bookly_gen_allow_staff_edit_profile' option is enabled by an administrator, a default setting on new installations.
Users are advised to update the Bookly WordPress plugin to version 28.5 or a later patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 10, 2026CISA-ADP
Assessed Oct 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bookly | <= 28.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 11, 2026 | CVE Modified | CISA-ADP |
| Oct 10, 2026 | New CVE Received | [email protected] |