Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-09-08T12:16:54.067Z",
  "pubdate": "2026-09-08T12:16:54.067Z",
  "executiveSummary": "The Bookly plugin for WordPress contains an Improper Authorization vulnerability within its administrative functionality. The flaw originates from the absence of appropriate capability checks within the 'updateAddon' function, which is designed to handle plugin addon updates.\nThis vulnerability allows authenticated users, specifically those with Subscriber-level privileges or higher, to trigger the update mechanism for arbitrary plugins that utilize a 'main.php' file structure. By invoking this function without verifying the requester's administrative permissions, the application improperly grants low-privileged users the ability to modify plugin states.\nThe risk implication is significant as it facilitates unauthorized control over plugin configurations and versions. While restricted to specific file structures, the ability for a non-administrative user to initiate update processes on the server represents a bypass of WordPress's core security model regarding plugin management. Exploitation requires existing authenticated access to the WordPress site, making it a target for internal privilege escalation or the forced deployment of outdated or modified software if the update source is compromised. No direct remote code execution is described, but the unauthorized modification of system components undermines the integrity of the WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) or Broken Access Control pattern located within the 'updateAddon' function of the Bookly plugin. The function fails to implement a 'current_user_can()' check or equivalent authorization verification before executing the update logic. In WordPress development, administrative actions must be gated by specific capabilities, such as 'manage_options' or 'update_plugins', to ensure that only authorized administrators can modify the plugin filesystem or state.\nThe vulnerability exists in all versions of the Bookly plugin up to and including version 27.2. The 'updateAddon' function is exposed in a way that allows a request originating from a low-privileged session to interact with the WordPress update API or the plugin's internal update handling routines. When the function is triggered, the plugin attempts to locate an addon based on the provided parameters. If the target plugin contains a 'main.php' file, the application processes the update request under the authority of the authenticated session, regardless of the user's role.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress instance with a Subscriber account. Second, the attacker crafts a malicious request targeting the 'updateAddon' endpoint or its corresponding AJAX/REST handler. The request must include the necessary identifiers that the 'updateAddon' function uses to locate the target plugin. Third, because the function lacks an authorization gate, it executes the backend update logic upon receiving the parameters from the attacker. The server then attempts to fetch and overwrite the plugin files based on the update metadata available to the system.\nThe impact of this exploitation is an unauthorized modification of the plugin's operational state. By triggering these updates, an attacker can effectively force the environment to pull code from remote repositories. If an attacker has the ability to influence the update source, this could lead to the installation of arbitrary code, although the primary impact described is the unauthorized execution of the update process itself. Furthermore, this vulnerability circumvents the intended administrative boundary, allowing users with minimal permissions to perform sensitive system maintenance tasks, which may lead to denial of service, environment instability, or the bypass of security-sensitive configuration controls implemented by site administrators."
}