The Bookly WordPress plugin before 28.3 incorrectly trusts client‑supplied booking quantity values. It does not validate these values on the server when computing the appointment total, allowing an unauthenticated user to set the quantity to zero and book a paid service for free. This flaw directly undermines the financial integrity of the site by generating revenue‑losing bookings.

Any WordPress installation that has the Bookly plugin at a version older than 28.3 is susceptible. Sites deploying these older versions can process unauthenticated booking requests that bypass the payment step.

The flaw carries a CVSS score of 5.3. The EPSS score is less than 1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can remotely exploit this issue by submitting crafted booking requests that include a manipulated quantity value; no credentials are required. Successful exploitation results in free paid appointments, potentially leading to financial loss.