CVE-2026-96348

Summary

The Bookly plugin allows unauthenticated users to bypass access controls and modify data through a broken access control vulnerability. This means attackers can perform actions they shouldn't be able to without needing to authenticate first.

Exploitability

Exploitation is straightforward with no authentication required, though it may need knowledge of specific API endpoints or parameters to trigger the access control bypass effectively.

Blast radius

The impact could be significant as attackers can modify booking data, potentially leading to double-booking, unauthorized changes, or manipulation of reservation information without any authentication.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 28.3 or later to remediate this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.