CVE-2026-93399criticalobserved exploitationCWE-639

CVE-2026-93399: critical vulnerability in ladela Online Scheduling and Appointment…

Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

Published · Updated

Follow this CVE+ Monitor Online Scheduling and Appointment Booking System – Bookly

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 9.1epss 0.6%
from disclosure to weaponsame day
Published on NVDSep 25
1st PoCSep 25
VulnCheckSep 25
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
ladela · Online Scheduling and Appointment Booking System – Bookly
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — ladela Online Scheduling and Appointment…

In the same product, most dangerous first.

CVE-2026-89063HIGHOnline Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' ParameterEPSS 1.6%CVE-2026-13424HIGHOnline Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX actionEPSS 0.6%CVE-2026-14516HIGHOnline Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL InjectionEPSS 0.5%CVE-2026-2519MEDIUMOnline Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'EPSS 0.5%CVE-2026-5513HIGHOnline Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' CookieEPSS 0.4%CVE-2026-12905MEDIUMOnline Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' ParameterEPSS 0.4%