Risk Letters

Exploited vulnerability

CVE-2026-93399

TLP:CLEAR

Authorization Bypass Through User-Controlled Key

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session,

Facts

  • Vendor: ladela
  • Product: Online Scheduling and Appointment Booking System – Bookly
  • CVSS: 9.1
  • EPSS (probability of exploitation within 30 days): 0.6 %
  • First known exploitation: 25 September 2026
  • First seen by Risk Letters: 25 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD