CVE-2026-104898: Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wpuserid' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the booklygenallowstaffeditprofile option (active on fresh installs) and links a WordPress user to a staff entry.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with at least subscriber-level access can exploit it, but the user must also be linked to at least one Bookly staff record.
Are fresh installations exposed by default?
Fresh installs are exposed when an administrator links a WordPress user to a staff entry, because the bookly_gen_allow_staff_edit_profile option is active on fresh installs. That setting causes a linked user to have the staff-record relationship required for exploitation.
What access can an attacker gain?
An attacker can overwrite the WordPress account binding for a Bookly staff record, including a record owned by an administrator. This can let the attacker hijack a higher-privileged staff member's account association and escalate privileges.
Which versions are affected?
All versions through 28.4, including 28.4, are affected.