CVE-2026-89063

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker along with the full private history. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations simply by incrementing the conversation_id parameter.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L212
https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L215
https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L38
https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L60
https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/lib/base/Component.php#L67
https://www.wordfence.com/threat-intel/vulnerabilities/id/b6af015f-f954-4afb-9d65-56176f73672f?source=cve

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 05:16

Updated : 2026-09-16 05:16

NVD link : CVE-2026-89063

Mitre link : CVE-2026-89063

CVE.ORG link : CVE-2026-89063

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-89063", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "ladela", "product": "Online Scheduling and Appointment Booking System \u2013 Bookly", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "28.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T05:16:47.313", "references": [{"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L212", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L215", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L38", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L60", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/lib/base/Component.php#L67", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b6af015f-f954-4afb-9d65-56176f73672f?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "The Online Scheduling and Appointment Booking System \u2013 Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer \u2014 leaking names, email addresses, phone numbers, and appointment details echoed by the assistant \u2014 and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker along with the full private history. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations simply by incrementing the conversation_id parameter."}], "lastModified": "2026-09-16T05:16:47.313", "sourceIdentifier": "security@wordfence.com"}