CVE-2026-86838

5.3 MEDIUM

Published 2026-09-28 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weaknesses

CWE-472

All references

https://wpscan.com/vulnerability/1c8a53e7-5556-4dcb-a461-c6df253d0b7a/

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-85010
UNSCOREDCVE-2026-94374PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.