CVE-2026-93399 — Bookly WordPress IDOR (Order Token Leak & Booking Rollback)

Overview

CVE-2026-93399 is an Insecure Direct Object Reference (IDOR) in the WordPress plugin Bookly (Bookly Responsive Appointment Booking Tool, slug bookly-responsive-appointment-booking-tool).

Public booking AJAX handlers allow an unauthenticated attacker to associate an arbitrary order_id with a form session and retrieve that order’s secret bookly_order token without proving ownership. From there, related actions can expose appointment data and cancel or delete non-completed bookings.

Affected versions

| | | |---|---| | Plugin | Bookly on WordPress.org | | Affected | ≤ 28.2 | | Fixed in | > 28.2 (upgrade to latest stable) | | CVSS 3.1 | 9.1 Critical (C:N/I:H/A:H) | | CWE | CWE-639 (Authorization Bypass Through User-Controlled Key) | | Auth | Unauthenticated (public booking AJAX) |

Technical summary

Reported chain:

1. bookly_get_form_id — Attacker-controlled order_id is stored in the form session.
2. bookly_render_complete — Returns the target order’s bookly_order token without verifying the session created that order.
3. bookly_add_to_calendar — Can expose appointment details when a valid order token is known.
4. bookly_rollback_order — Can cancel/delete non-completed bookings when invoked with a leaked token.

Attackers may enumerate order IDs on vulnerable sites to harvest tokens at scale.

Bundled PoC (PoCbit download)

Python 3 tool with check and exploit modes:

• check — Detect Bookly, plugin version ≤ 28.2, optional --order-id or --order-start / --order-end enumeration for token leakage signals.
• exploit — Uses a known order-id; optional --calendar (appointment data) and --rollback --confirm-delete (destructive — authorized labs only).

Mass scan: --list targets.txt --mode check -j 10 with bounded order ID ranges. Use only on systems you own or have written permission to test.

Impact

• Confidentiality: Appointment and customer booking metadata exposure.
• Integrity / availability: Unauthorized cancellation or removal of active bookings (business disruption, SLA impact on clinics/salons using Bookly).

Remediation

1. Upgrade Bookly to > 28.2 immediately.
2. Review recent booking cancellations and order/token usage in logs.
3. Rate-limit admin-ajax.php Bookly actions at the WAF where possible.
4. Monitor for sequential order_id probing against public booking forms.

Legal and ethical use

--rollback --confirm-delete permanently affects real bookings. Never run exploit or rollback modes against production tenants without explicit authorization.

References

• GitHub PoC (source): https://github.com/murrez/CVE-2026-93399
• NVD — CVE-2026-93399
• CVE Program