[ CVE-2026-86837 · Published 25 Sep 2026 ]
Vulnerability in Unknown Bookly
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.