Bookly CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Bookly CVE published 2026-09-28

CVE-2026-86838

CVE-2026-86838 is a vulnerability in the Bookly WordPress plugin that allows unauthenticated users to book paid services for free by bypassing the payment step. The plugin does not validate client-supplied booking quantity values on the server before computing the appointment total. Defenders responsible for WordPress installations using the Bookly plugin should assess exposure and prioritize verification [truncated]

HIGH Bookly CVE published 2026-06-15

CVE-2026-42667

CVE-2026-42667 is a HIGH severity vulnerability (CVSS Score: 7.5) affecting Bookly versions <= 27.4. This vulnerability allows unauthenticated sensitive data exposure. The vulnerability was published on [cvePublishedAt] and last modified on [cveModifiedAt].