CVE-2026-86841: Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Booklyto a version that resolves this vulnerability.Fixed in 28.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a WordPress account that has been explicitly granted Bookly’s custom booking-management capability. The issue is not described as exploitable by unauthenticated users or ordinary users without that assigned capability.
Are default Bookly permissions affected?
Exploitation requires an administrator to explicitly assign the relevant custom booking-management capability. The available information does not indicate that this capability is granted by default.
What is the impact if exploitation succeeds?
A permitted attacker can inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets. This may expose credentials or tokens used by connected integrations.
What versions should be remediated?
Bookly versions before 28.3 are affected; the reported affected range includes 23.2 through 28.2. Update to 28.3 or later.
What can be done if updating is not immediately possible?
Review accounts and roles for the custom Bookly booking-management capability and remove it from users who do not strictly require it. Restrict access to the affected maintenance functionality to trusted administrators until the plugin can be updated.