CVE-2026-12905: Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=booklymobilestaffcabinet) in frontend/modules/mobilestaffcabinet/api/handlers/Handler10.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staffid matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLESTAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid accesskey token bound to a Staff entity), to read appointment details — including the internal note and the full customerappointments collection (customer fullname, email, phone, notes, customfields, extras, paymenttotal, paymenttype, paymentstatus) — belonging to other staff members by enumerating sequential appointment IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Bookly pluginto a version that resolves this vulnerability.Fixed in 27.7 - Configuration
Update the Bookly plugin so the appointment() handler does not load an Appointment solely from attacker-supplied params[id]; it must verify that the loaded appointment's staff_id matches the authenticated staff member (scoping to $this->staff->getId() as done by deleteAppointment/saveAppointment/appointments list for ROLE_STAFF).
Bookly (Mobile Staff Cabinet API) params[id] handling in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php (appointment() method) = Validate appointment.staff_id matches authenticated staff member before loading appointment - Compensating control
Restrict use of the Bookly mobile staff cabinet access_key tokens to only the minimum staff users that require access; prevent broad staff-level access where possible to reduce the ability to enumerate sequential appointment IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12905?
CVE-2026-12905 has a medium severity rating of 4.3.
How do I fix CVE-2026-12905?
To fix CVE-2026-12905, update the Bookly plugin for WordPress to the latest version beyond 27.7.
What are the potential impacts of CVE-2026-12905?
CVE-2026-12905 can lead to the exposure of sensitive information due to insecure direct object references.
Is CVE-2026-12905 exploitable without authentication?
CVE-2026-12905 requires authentication as it specifically affects authenticated staff users.
Which software is affected by CVE-2026-12905?
CVE-2026-12905 affects the Bookly plugin for WordPress in versions up to and including 27.7.