Description
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Published: 2026-04-09
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated price manipulation
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker to supply a negative number to the 'tips' parameter in the booking process. The plugin trusts this input without server‑side validation, causing the calculated total price to be reduced to zero. As a result, users can book appointments without paying, directly eroding the site owner's revenue.

Affected Systems

WordPress installations that use the Bookly scheduling plugin version 27.0 or earlier are affected. The vulnerability exists in the core booking module of the plugin and is not limited to a specific WordPress theme or custom code.

Risk and Exploitability

The severity is rated moderate with a CVSS score of 5.3. No exploit probability data is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger it via an unauthenticated HTTP request to the booking endpoint, and no authentication or advanced privileges are required. The impact is primarily financial loss rather than system compromise.

Generated by OpenCVE AI on April 9, 2026 at 14:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Bookly to the latest released version that removes the unchecked 'tips' input.
  • If an immediate update is not possible, add server‑side validation to reject negative or non‑positive tip values and ensure the total price cannot fall below the base cost.
  • Enable monitoring of booking submissions to detect zero‑price appointments and consider disabling the booking feature temporarily until the validation is in place.

Generated by OpenCVE AI on April 9, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Apr 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Apr 2026 09:00:00 +0000

Type Values Removed Values Added
First Time appeared Ladela
Ladela online Scheduling And Appointment Booking System – Bookly
Wordpress
Wordpress wordpress
Vendors & Products Ladela
Ladela online Scheduling And Appointment Booking System – Bookly
Wordpress
Wordpress wordpress

Thu, 09 Apr 2026 13:00:00 +0000

Type Values Removed Values Added
Description The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.
Title Online Scheduling and Appointment Booking System – Bookly <= 27.0 - Unauthenticated Price Manipulation via 'tips'
Weaknesses CWE-472
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Ladela Online Scheduling And Appointment Booking System – Bookly
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-13T15:15:09.493Z

Reserved: 2026-02-15T06:39:59.038Z

Link: CVE-2026-2519

cve-icon Vulnrichment

Updated: 2026-04-13T15:11:53.345Z

cve-icon NVD

Status : Deferred

Published: 2026-04-09T13:16:42.843

Modified: 2026-04-24T18:02:46.583

Link: CVE-2026-2519

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-10T09:32:51Z

Weaknesses