CVE-2026-86837: Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Bookly WordPress pluginto a version that resolves this vulnerability.Fixed in 28.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Bookly WordPress plugin before version 28.3 are affected. The issue concerns customer records stored by the plugin.
What does an attacker need to exploit it?
An attacker does not need authentication or user interaction, but must know a customer's primary identifier. They can use it to overwrite stored customer details including the name, email address, and address.
What is the impact of successful exploitation?
The described impact is unauthorized modification of customer personal information. The supplied severity vector indicates integrity impact only, with no stated confidentiality or availability impact.