The WordPress Add‑on releases all booking endpoints with an impersonation‑safe AJAX hook, and the form handler uses a loose non‑strict comparison to validate a one‑time verification code before permitting customer data changes. When the attacker supplies the boolean value true as the verification code, PHP’s type juggling causes the inequality operator to evaluate as false, allowing the comparison guard to be skipped. The result is that any unauthenticated individual can edit the name, email, phone, and address fields of any existing customer record and redirect future booking notifications to arbitrary contact details. The weakness is a classic authorization bypass, captured by CWE‑285.

All installations of the Bookly plugin from vendor ladela for WordPress with version numbers up to and including 28.2 are affected. The vulnerability exists regardless of site configuration or hosting environment, as the AJAX endpoint is publicly exposed for word‑press sites using the plugin.

The CVSS score of 5.3 marks a moderate severity. Because the flaw is exercised by sending a crafted request to a public AJAX endpoint with no authentication or CSRF token, the attack vector is straightforward. An attacker would simply submit an HTTP request with the verification_code set to true. Although no EPSS score is available, the lack of an exploitation barrier and the fact that the plugin is widely used suggests that the vulnerability could be abused with low difficulty. The vulnerability is not listed in the CISA KEV catalog, but the ease of exploitation warrants rapid mitigation.