CVE-2026-93399 - IDOR Vulnerability in Bookly WordPress Plugin

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) exploitation in versions 28.2 and earlier. The vulnerability stems from improper validation within several AJAX handlers, specifically 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order'.

The 'bookly_get_form_id' handler accepts an attacker-supplied 'order_id' from user-submitted form data and stores it in the booking session without verification. Subsequent handlers, such as 'bookly_render_complete', trust this session-stored ID to look up and return sensitive order tokens. This flaw enables unauthenticated attackers to enumerate sequential order IDs, leading to the unauthorized disclosure of customer order tokens and appointment details. Furthermore, the 'bookly_rollback_order' handler allows attackers to permanently delete arbitrary non-completed bookings, which triggers cascading deletions of associated customer appointment records. This vulnerability poses a significant risk to data privacy and service integrity for organizations utilizing the Bookly plugin.