CVE-2026-86838: Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote user can exploit it; no account, prior privileges, or user interaction is required. The attacker needs to submit manipulated booking quantity values during the booking process.
What is the impact on affected sites?
An attacker can reduce an appointment total to zero, bypass the payment step, and book paid services without payment. The vulnerability affects the integrity of booking and payment handling rather than confidentiality or availability.
Which versions need remediation?
Bookly versions before 28.3 are affected. Update the Bookly WordPress plugin to version 28.3 or later.