CVE-2026-2520: Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/booklyto a version that resolves this vulnerability.Fixed in 27.2
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Any authenticated WordPress account with Subscriber-level access or higher can exploit it. No administrator-level capability is required.
What can an attacker change through the vulnerable function?
An attacker can update a plugin to its latest version when that plugin's main file is named main.php. The issue is limited to plugin updates rather than arbitrary plugin installation or arbitrary code modification.
Which Bookly versions are affected?
All Bookly versions up to and including 27.2 are affected.