The vulnerability is a subscriber Insecure Direct Object Reference (IDOR) that permits an attacker to access or modify data belonging to other users by tampering with request parameters. This flaw can lead to unauthorized disclosure of sensitive booking information as well as manipulation of appointments and related data, compromising both confidentiality and integrity of user data within the WordPress Bookly plugin. No escalation of privilege beyond what the compromised account already possesses is required, but the impact on data integrity is significant because it allows an attacker to alter or delete appointment records.

Bookly, the WordPress appointment booking plugin, is affected in all releases up to and including version 28.2. The fix is available from version 28.3 onward.

The CVSS score of 6.5 classifies this as a medium severity vulnerability, and the EPSS score is not available, so current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is the plugin’s web interface, where an attacker can manipulate request parameters. The exploitation requires knowledge of the target’s structure and the ability to craft requests, but does not require privileged rights beyond a normal user or subscriber-level access. Because the flaw relies on improper access control, any authenticated or unauthenticated user capable of interacting with Bookly endpoints could potentially exploit it.