CVE-2026-96348: WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Published Sep 30, 2026
·Updated
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Affected Software
1 affected component
Bookly Bookly plugin<=28.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Bookly pluginto a version that resolves this vulnerability.Fixed in 28.3
Event History
Sep 30, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or any existing privileges to exploit it.
2
What versions are affected?
Bookly plugin versions 28.2 and earlier are affected according to the available data.
3
What is the likely security impact?
The listed impact is integrity-only: an attacker may be able to perform unauthorized modifications. No confidentiality or availability impact is identified in the supplied severity vector.