Bookly (<= 28.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/bookly--28.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 16 Sep 2026 05:46:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgIDOR Vulnerability in Bookly WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-bookly-idor/Wed, 16 Sep 2026 05:46:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-bookly-idor/An Insecure Direct Object Reference (IDOR) vulnerability in the Bookly WordPress plugin allows unauthenticated attackers to enumerate and exfiltrate private AI booking transcripts via sequential ID incrementation.The Bookly WordPress plugin, specifically versions 28.1 and earlier, contains an Insecure Direct Object Reference (IDOR) vulnerability identified as CVE-2026-89063. The vulnerability stems from the 'conversation_id' parameter in the plugin's AI booking functionality, which fails to enforce access control or validate that the requesting user owns the requested conversation session. Because the conversation IDs are assigned as sequential integers, an unauthenticated attacker can systematically enumerate these values to access sensitive customer data stored in AI booking transcripts, including names, email addresses, phone numbers, and appointment details. Beyond data exfiltration, the flaw permits attackers to inject arbitrary messages into active or historical conversations, which are then processed by the cloud AI worker. This capability creates a significant risk for unauthorized access to customer interactions and data leakage across any WordPress site running the affected plugin versions.

Impact

Successful exploitation allows unauthenticated actors to harvest PII for all scheduled appointments and manipulate interactions with the AI assistant. This presents a severe privacy risk to organizations using the plugin for scheduling, potentially leading to unauthorized data exposure and the compromise of automated customer service workflows.

Recommendation

Prioritized actions for security and IT teams:

  • Update the Bookly plugin for WordPress to the latest available version beyond 28.1 to mitigate CVE-2026-89063.
  • Audit web server access logs for anomalous, high-frequency GET or POST requests directed at the Bookly conversation API endpoint involving incrementing integer parameters in the 'conversation_id' field.
  • Monitor for unauthorized access patterns where a single IP address requests a broad range of sequential conversation IDs, which is a strong indicator of enumeration attempts against this IDOR vulnerability.
]]>highadvisoryweb-applicationwordpressidorcve-2026-89063