CVE-2026-12626: Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to WordPress and have custom-level access or higher in the affected Bookly plugin. Unauthenticated visitors are not described as able to exploit it.
What versions are affected?
All Bookly versions up to and including 28.2 are affected.
Is there a known path from object injection to code execution?
No known gadget chain is available. The disclosed issue allows injection of a PHP object through the value parameter, but the data does not identify a gadget chain for further exploitation.