The Bookly plugin: critical vulnerability

The Bookly plugin

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions.

Still cooking for Online Scheduling and Appointment Booking System – Bookly.

First seen: 27 Oct 2026
Last update: 27 Oct 2026, 09:17 UTC
Identifiers: CVE-2026-93399
CVSS: 9.1
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## The Bookly plugin: critical vulnerability
Severity: critical. Patch status: fix status unknown.
Affected: The Bookly plugin
Ids: CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions.

## Steps
1. Search the repo, its CI and infra config for The Bookly plugin. If present, report the version in use and whether it's affected.
2. Online Scheduling and Appointment Booking System – Bookly <= 28.2: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Online Scheduling and Appointment Booking System – Bookly <= 28.2 | not named in the CVE record | check the vendor advisory: https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L1111 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-93399") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-93399 https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.2/frontend/modules/booking/Ajax.php#L1111
https://pwned.coffee/i/the-bookly-plugin-for-wordpress-is-vulnerable-to-insecur-cve-2026-93399

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Online Scheduling and Appointment Booking System – Bookly <= 28.2 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 27 Oct
The CVE record names no fix for one line; the vendor’s advisory may: plugins.trac.wordpress.org
Score: CVSS 9.1 (critical). CVSS 3.1 9.1 (CNA Wordfence) for CVE-2026-93399
Last checked: 27 Oct 2026, 09:18 UTC

Product	Affected	Fixed in	Source
Online Scheduling and Appointment Booking System – Bookly	<= 28.2	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 27 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee