The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id…
Medium CVSS 6.8
Summary
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-p…
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L111
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L364
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L93
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Entity.php#L172
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Entity.php#L247
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Request.php#L49
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3730881%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.5&old=3722721%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3cfaa5-00e3-41b6-8f38-cebdd5dec180?source=cve
Timeline
- nvd_ingest NVD