CVE-2026-92799: Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer() function using a loose PHP inequality operator (!=) to compare the session-stored one-time verification code against the attacker-supplied verificationcode parameter — a flaw that is further exposed by the booking AJAX controller registering all its methods as wpajaxnopriv handlers and unconditionally overriding csrfTokenValid() to return true, leaving the endpoint both unauthenticated and CSRF-unprotected. This makes it possible for unauthenticated attackers to bypass the phone/email ownership verification step and overwrite the name, email, phone, and address fields of any arbitrary existing Bookly customer record, redirecting that customer's booking notifications to attacker-controlled contact details. The bypass is achievable because the jsondata input channel decodes input via jsondecode(), which preserves real PHP types and causes the wpkses filter to leave non-string values such as the JSON boolean true untouched; submitting true as the verificationcode satisfies the loose comparison against the session's non-zero integer code (generated by mtrand(100000, 999999)), causing true != <non-zero int> to evaluate as false and the guard to be bypassed.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using the Bookly plugin at version 28.2 or earlier are affected. The vulnerable booking endpoint is available without authentication, so an attacker does not need a WordPress account.
What does an attacker need to exploit it?
An attacker can submit crafted data through the booking AJAX endpoint, using the json_data channel to supply a non-string verification_code value such as the JSON boolean true. No credentials, user interaction, or prior ownership of the targeted customer's phone number or email address is required.
What can an attacker change after bypassing verification?
An attacker can overwrite the name, email address, phone number, and address fields of an arbitrary existing Bookly customer record. This can redirect that customer's booking notifications to contact details controlled by the attacker.
Are standard anti-CSRF protections a mitigating factor?
No. The booking controller registers its methods as unauthenticated handlers and unconditionally treats CSRF token validation as successful, leaving this endpoint unauthenticated and CSRF-unprotected.