[ CVE-2026-86838 · Published 28 Sep 2026 ]
Vulnerability in Unknown Bookly
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.