The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_i…
High CVSS 7.5
Summary
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbi…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L212
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L215
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L38
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/frontend/modules/ai/Ajax.php#L60
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.1/lib/base/Component.php#L67
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b6af015f-f954-4afb-9d65-56176f73672f?source=cve
Timeline
- nvd_ingest NVD