Skip to content
Sign in
5.3 Medium

CVE-2026-86837 The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored…

Description

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

Affected products and versions

Product Affected versions Fixed in
Bookly 28.3 earliest → < 28.3 28.3

Other CVEs of Bookly

The 2 CVEs of Bookly →
CVE-2026-86838 The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before… 5.3 Medium
Track this CVE