Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access
CVE-2026-89063
Early Release
Description
Bookly WordPress plugin <= 28.1 contains an insecure direct object reference caused by missing validation on 'conversation_id' parameter, letting unauthenticated attackers read and inject messages into any AI booking conversation, exploit requires no authentication.
Severity
High
CVSS Score
8.2
Affected Product
bookly-responsive-appointment-booking-tool
Published Date
September 23, 2026
Template Author
0x_akoko
CVE-2026-89063.yaml
8.2Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE ID:
cve-2026-89063
CWE ID:
cwe-639
References
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool/online-scheduling-and-appointment-booking-system-281-insecure-direct-object-reference-to-unauthenticated-sensitive-data-access-and-message-injection-via-conversation-id-parameterhttps://www.cve.org/CVERecord?id=CVE-2026-89063
Remediation Steps
Update to the latest version beyond 28.1.