CVE-2026-93399 is a critical-severity (CVSS 9.1) insecure direct object reference (IDOR) flaw in the Bookly booking plugin for WordPress, in versions up to and including 28.2. An attacker with no account can use it to read other customers' booking data and permanently delete their bookings.
What Is It
The flaw is an IDOR (CWE-639) in four AJAX actions: bookly_get_form_id, bookly_render_complete, bookly_add_to_calendar and bookly_rollback_order. The bookly_get_form_id handler takes the order_id from submitted form data, which the attacker controls, and stores it in a new booking session without checking it. The bookly_render_complete handler then trusts that stored value. It looks up the matching order and returns the order's secret token without checking that the current session created the order.
Why It Matters
According to the NVD description, unauthenticated attackers can:
- Enumerate sequential order IDs
- Expose other customers' order tokens
- Retrieve calendar and appointment information via
bookly_add_to_calendar - Permanently delete any booking that isn't completed via
bookly_rollback_order
A deletion also removes the linked customer_appointment record. If no other customers are attached to the appointment, the appointment itself is deleted too.
Wordfence scored it CVSS 3.1 9.1 (CRITICAL), vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. The attack works over the network, is low complexity, and needs no privileges or user interaction. The impact on integrity and availability is rated high.
CVE-2026-93399 is not in the CISA Known Exploited Vulnerabilities catalog, and none of the supplied sources confirm active exploitation.
What's Vulnerable
- Vendor: ladela
- Product: Online Scheduling and Appointment Booking System – Bookly (WordPress plugin)
- Affected versions: all versions up to and including 28.2
The NVD record's status is "Deferred" and it lists no CPEs.
Patch Status
The supplied data does not name a fixed version. The references include a WordPress plugin changeset for Bookly, but the record does not tie it to a specific release. There is no CISA KEV entry, so no federal required action or due date applies.
If you run Bookly 28.2 or earlier:
- Check the Wordfence advisory and the plugin's changelog to find out whether a newer release fixes the flaw.
- Update as soon as a fixed version is confirmed.
- Until then, check booking records for unexpected deletions.