Description

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-09-25T07:16:56.027Z",
  "pubdate": "2026-09-25T07:16:56.027Z",
  "executiveSummary": "The Bookly plugin for WordPress (up to version 28.2) contains a critical Insecure Direct Object Reference (IDOR) vulnerability.\nThe flaw exists within several AJAX actions, including 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order'.\nAn unauthenticated attacker can exploit this to enumerate order IDs, disclose private order tokens, retrieve sensitive customer appointment data, and delete arbitrary bookings.\nThe root cause is a failure to perform server-side ownership verification when processing order-related data in session handlers.\nThis vulnerability poses a significant risk to customer data privacy and business integrity, as it allows for unauthorized access to internal booking records and data destruction.\nNo authentication is required for exploitation, making it accessible to any remote, unauthenticated user capable of interacting with the plugin's AJAX endpoints.",
  "technicalDetails": "The vulnerability resides in the way Bookly manages booking sessions and retrieves order-related data via WordPress AJAX hooks. Specifically, the 'bookly_get_form_id' handler accepts an 'order_id' parameter directly from user-supplied 'form_data' and commits it to the current user's session without validation.\nThis creates a state of trust for subsequent actions. The 'bookly_render_complete' handler subsequently utilizes this stored 'order_id' to fetch sensitive information, such as the customer's unique secret token, without verifying that the session owner actually initiated or owns the requested order.\nAn attacker can exploit this design flaw by sequentially incrementing or guessing 'order_id' values. By submitting requests to 'bookly_get_form_id' followed by 'bookly_render_complete', the attacker can systematically scrape secret tokens for arbitrary orders across the platform.\nOnce these tokens are obtained, the attacker can leverage the 'bookly_add_to_calendar' action to disclose detailed appointment information, effectively bypassing authorization controls meant to restrict access to booking data.\nFurthermore, the 'bookly_rollback_order' action is vulnerable to the same lack of authorization checks. By providing an arbitrary 'order_id', an attacker can trigger the deletion of records within the database. This function performs a cascade deletion, removing the corresponding 'customer_appointment' record and, if no other customers remain associated, the underlying appointment object.\nThe attack flow proceeds as follows: 1) The attacker identifies a target 'order_id'. 2) The attacker calls 'bookly_get_form_id' with the target ID to populate the session. 3) The attacker triggers 'bookly_render_complete' or 'bookly_add_to_calendar' to exfiltrate order details or secret tokens. 4) The attacker invokes 'bookly_rollback_order' to permanently delete booking data.\nBecause the plugin does not enforce ownership validation or session-specific constraints, these AJAX actions can be accessed by any unauthenticated remote user, allowing for massive data exposure and denial-of-service through unauthorized deletion."
}