CVE-2026-104898 ladela CVE debrief

Who should care

Defenders responsible for WordPress installations using the Online Scheduling and Appointment Booking System – Bookly plugin should assess exposure and prioritize verification and remediation efforts.

Why it matters

The vulnerability allows authenticated attackers to escalate privileges and potentially overwrite WordPress account bindings for Bookly staff records, requiring defenders to verify the presence of this vulnerability and assess exposure.

• Privilege escalation for authenticated attackers
• Potential overwriting of WordPress account bindings for Bookly staff records
• Exposure of staff records to unauthorized access

Technical summary

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of staff records.

Recommended defensive actions

• Verify the presence of this vulnerability in WordPress installations
• Assess exposure of staff records
• Apply patches or updates to affected versions
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and affected versions. The vulnerability allows authenticated attackers to escalate privileges and potentially overwrite WordPress account bindings for Bookly staff records. Defenders should verify the presence of this vulnerability in their WordPress installations and assess exposure of staff records. The CVE Program record and NVD detail page offer additional information on the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.