Description

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-25T09:17:06.210Z",
  "pubdate": "2026-09-25T09:17:06.210Z",
  "executiveSummary": "The Bookly WordPress plugin prior to version 28.3 contains an improper authentication vulnerability within its customer profile update functionality.\nThis flaw allows unauthenticated remote attackers to modify arbitrary customer personal information, including names, email addresses, and physical addresses.\nThe vulnerability stems from a failure to perform adequate identity verification before processing requests to update stored user data.\nExploitation requires the attacker to possess knowledge of a target's primary identifier, such as a customer ID, but does not necessitate authentication or specific administrative privileges.\nThe primary risk involves unauthorized data manipulation, potential account takeover scenarios via email modification, and significant privacy breaches for users of the booking platform.\nSuccessful exploitation exposes the integrity of user records, allowing attackers to hijack booking communications or perform identity fraud by associating victim accounts with attacker-controlled contact information.",
  "technicalDetails": "The root cause of this vulnerability is an insecure implementation of the customer profile update mechanism within the Bookly plugin. The application fails to validate the current session context or require secondary authentication markers when a request is sent to modify existing customer records.\nThe affected component resides in the plugin's data processing logic for customer profile management. Because the API endpoints responsible for these updates do not verify the authenticity of the requester, they are susceptible to unauthorized manipulation.\nThe attack flow begins when an attacker identifies the target customer’s primary identifier, which is often a predictable or discoverable numerical ID or unique string. Once identified, the attacker crafts a malicious HTTP request directed at the relevant endpoint responsible for profile updates.\nBy injecting the target's identifier into the request parameters alongside the desired modifications—such as an attacker-controlled email address—the attacker triggers the backend logic to overwrite the existing database entry for that customer. The server processes the request as if it originated from the authorized owner of the record, as there is no server-side validation ensuring that the current requester matches the subject of the profile update.\nThis vulnerability is classified as an Improper Authentication issue, specifically leading to an Insecure Direct Object Reference (IDOR) or Broken Access Control, depending on the implementation details. Since the system trusts the incoming identifier without a secure verification token (e.g., a nonce or session-bound authentication), it exhibits a failure to enforce the principle of least privilege.\nPost-exploitation impact includes the permanent alteration of user data. By changing a user's associated email address, an attacker can successfully facilitate secondary attacks, such as password reset requests, enabling full account takeover. Furthermore, modifying contact details can lead to the diversion of booking confirmations, sensitive notifications, or payment-related communication, potentially leading to financial fraud or the harvesting of PII (Personally Identifiable Information)."
}