What’s Vulnerable › Vulnerabilities
CVE-2026-86838: Bookly < 28.3 - Unauthenticated Payment Bypass via Booking Price Manipulation
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-28 · updated 2026-09-28
- Weakness: CWE-472
Description
The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.
Affected products
- Bookly: before 28.3 — fixed in 28.3
How to fix
Upgrade to a fixed version: Bookly 28.3. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86838 or the next vulnerability affects your stack