CVE-2026-86838
Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
| Vendor | unknown |
| Product | bookly |
| Published | Sep 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown bookly
Be the first to know when new medium vulnerabilities affecting unknown bookly are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Bookly
0 < 28.3
References
Credits
vuxvinh WPScan