CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 8, 2026
Description
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | WPScan |
Weaknesses
- CWE-472 External Control of Assumed-Immutable Web Parameter
Affected Products
| Product | Versions |
|---|---|
BooklyUnknown |
|
References
- https://wpscan.com/vulnerability/1c8a53e7-5556-4dcb-a461-c6df253d0b7a/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.