Insecure Direct Object Reference in Bookly Plugin for WordPress

CVE-2026-12905

What is CVE-2026-12905?

The Bookly plugin for WordPress has a vulnerability that allows authenticated attackers with staff-level mobile cabinet access to exploit the appointment() method of the Mobile Staff Cabinet API. This flaw occurs because the handler processes an Appointment based on an attacker-supplied parameter without verifying if the appointment’s staff_id corresponds to the authenticated staff member. As a result, attackers can enumerate appointment IDs to gain access to sensitive details about appointments made by other staff members, including private notes and customer information such as names, emails, and payment statuses.

References