POCBIT
Log inSign up

CVE-2026-93399 — Bookly WordPress IDOR (Order Token Leak & Booking Rollback)

Bookly ≤ 28.2: unauthenticated IDOR on booking AJAX — bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; calendar export and rollback cancel non-completed bookings. CVSS 3.1 9.1 Critical (CWE-639).

#wordpress#bookly#idor#cwe-639#appointment-booking#unauthenticated

CVE:

CVE-2026-93399

Date:

2026-09-25

Severity:

CRITICAL

Exploit source

PoC code is available to registered members only.

Log inSign up

Description

Overview

CVE-2026-93399 is an Insecure Direct Object Reference (IDOR) in the WordPress plugin Bookly (Bookly Responsive Appointment Booking Tool, slug bookly-responsive-appointment-booking-tool).

Public booking AJAX handlers allow an unauthenticated attacker to associate an arbitrary order_id with a form session and retrieve that order’s secret bookly_order token without proving ownership. From there, related actions can expose appointment data and cancel or delete non-completed bookings.

Affected versions

| | | |---|---| | Plugin | Bookly on WordPress.org | | Affected | ≤ 28.2 | | Fixed in | > 28.2 (upgrade to latest stable) | | CVSS 3.1 | 9.1 Critical (C:N/I:H/A:H) | | CWE | CWE-639 (Authorization Bypass Through User-Controlled Key) | | Auth | Unauthenticated (public booking AJAX) |

Technical summary

Reported chain:

  1. bookly_get_form_id — Attacker-controlled order_id is stored in the form session.
  2. bookly_render_complete — Returns the target order’s bookly_order token without verifying the session created that order.
  3. bookly_add_to_calendar — Can expose appointment details when a valid order token is known.
  4. bookly_rollback_order — Can cancel/delete non-completed bookings when invoked with a leaked token.

Attackers may enumerate order IDs on vulnerable sites to harvest tokens at scale.

Bundled PoC (PoCbit download)

Python 3 tool with check and exploit modes:

  • check — Detect Bookly, plugin version ≤ 28.2, optional --order-id or --order-start / --order-end enumeration for token leakage signals.
  • exploit — Uses a known order-id; optional --calendar (appointment data) and --rollback --confirm-delete (destructive — authorized labs only).

Mass scan: --list targets.txt --mode check -j 10 with bounded order ID ranges. Use only on systems you own or have written permission to test.

Impact

  • Confidentiality: Appointment and customer booking metadata exposure.
  • Integrity / availability: Unauthorized cancellation or removal of active bookings (business disruption, SLA impact on clinics/salons using Bookly).

Remediation

  1. Upgrade Bookly to > 28.2 immediately.
  2. Review recent booking cancellations and order/token usage in logs.
  3. Rate-limit admin-ajax.php Bookly actions at the WAF where possible.
  4. Monitor for sequential order_id probing against public booking forms.

Legal and ethical use

--rollback --confirm-delete permanently affects real bookings. Never run exploit or rollback modes against production tenants without explicit authorization.

References