The Bookly WordPress plugin contains an insecure direct object reference flaw in its Mobile Staff Cabinet API appointment() method. The API loads an appointment record based solely on an attacker‑supplied appointment ID without checking that the caller’s staff ID matches the appointment’s staff member. This omission allows an authenticated staff user—anyone with a valid mobile cabinet access token bound to a Staff entity—to read appointment details, including internal notes and the full customer appointment collection, of appointments belonging to other staff members. The flaw does not enable remote code execution or denial of service; its primary impact is the disclosure of confidential customer and business information.

The vulnerability is present in the Bookly scheduling plugin for WordPress from the ladela vendor. All plugin versions up to and including 27.7 are affected. No earlier or later versions are known to be impacted.

The CVSS score of 4.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of active exploitation. However, the flaw requires only authenticated staff access, a condition that is common in normal operations, making enumeration of other staff appointments feasible. Because the attacker can obtain sensitive customer data, the risk to confidentiality is significant even though the exploitation probability appears low based on current data.