CVE-2026-93399 ladela CVE debrief

Who should care

WordPress administrators, security teams, and users of the Bookly plugin should assess their exposure and apply patches or updates to prevent potential exploitation. This includes reviewing system logs for suspicious activity, ensuring that all instances of the plugin are updated, and considering additional security measures to protect against exploitation. Operators managing WordPress environments, platform administrators, and vulnerability management and

Why it matters

CVE-2026-93399 is a critical vulnerability in the Bookly plugin for WordPress, allowing unauthenticated attackers to exploit multiple AJAX actions. WordPress administrators and security teams should assess exposure and apply patches or updates to prevent potential exploitation.

• Enumeration of sequential order IDs
• Disclosure of other customers' order tokens
• Retrieval of calendar/appointment information
• Permanent deletion of arbitrary non-completed bookings

Technical summary

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2. The vulnerability is caused by the 'bookly_get_form_id' handler storing attacker-controlled 'order_id' into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order.

Defensive priority

High priority for WordPress administrators and security teams to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the installed version of the Bookly plugin is 28.2 or earlier.
• Apply patches or updates provided by the vendor to fix the vulnerability.
• Monitor for suspicious activity related to the Bookly plugin's AJAX actions.
• Consider implementing additional security measures to protect against potential exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is due to the 'bookly_get_form_id' handler storing attacker-controlled 'order_id' into a new booking session, which the 'bookly_render_complete' handler trusts without verification. This allows attackers to exploit multiple AJAX actions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.