CVE-2026-103365: Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 28.4 via the classic booking form's Details step. The endpoint booklyrenderdetails is registered for both wpajax and wpajaxnopriv, the module overrides csrfTokenValid() to always return true, and Bookly\Frontend\Components\Booking\InfoText::getCodes() calls UserBookingData::getCustomer() to load the persisted Customer entity keyed solely by the attacker-supplied phone (or email) with no invocation of the plugin's own customerIdentityConfirmed() predicate. When a site owner has placed the supported {clientname}, {clientemail}, {clientphone}, or {clientnote} placeholders into the Details step's Appearance information text, the matched customer's stored name, email, phone and internal notes are substituted into the returned HTML. This makes it possible for unauthenticated attackers who know only a registered customer's primary phone (or email) to read that customer's stored personal data.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to customer-data disclosure?
Sites using the classic booking form are exposed when the Details step's Appearance information text contains one or more supported client placeholders: {client_name}, {client_email}, {client_phone}, or {client_note}. The data returned depends on which of those placeholders the site owner configured.
What does an attacker need to retrieve a customer's information?
An attacker does not need to authenticate or interact with a victim. They need only the registered customer's primary phone number or email address to cause the booking endpoint to load that customer's persisted record.
How can an administrator determine the potential scope of exposure?
Review the classic booking form's Details-step Appearance information text for the supported client placeholders. If present, assess the corresponding stored customer fields, including names, email addresses, phone numbers, and internal notes, as potentially retrievable by someone who knows a registered customer's phone number or email address.