Description
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Published: 2026-09-30
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated access that enables use of privileged plugin functions
Action: Upgrade
AI Analysis

Impact

Unauthenticated Broken Access Control exists in the Bookly plugin versions 28.2 and earlier. Attackers can bypass authentication checks to invoke actions intended only for authenticated users. This weakness is classified as CWE-862.

Affected Systems

WordPress installations that use the Bookly plugin, specifically versions 28.2 and earlier. The vulnerability affects the plugin's access control logic regardless of the WordPress core version.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The flaw is triggered without authentication, enabling an attacker with network or public internet access to send crafted requests to the plugin endpoints that normally require authentication. Based on the severity score, it is inferred that this vulnerability poses a significant risk to exposed WordPress sites.

Generated by OpenCVE AI on September 30, 2026 at 16:40 UTC.

Remediation

Vendor Solution

Update the WordPress Bookly plugin to the latest available version (at least 28.3).

OpenCVE Recommended Actions

  • Update the Bookly plugin to version 28.3 or later to remove the broken access control.
  • If an immediate update is not possible, block unauthenticated access to the plugin by disabling it or using a firewall rule to restrict its endpoints.
  • Apply strict role-based access controls and review WordPress user permissions to ensure that only authorized roles can invoke the plugin’s privileged functions.

Generated by OpenCVE AI on September 30, 2026 at 16:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 30 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
Title WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-09-30T13:27:06.638Z

Reserved: 2026-09-23T00:18:19.473Z

Link: CVE-2026-96348

cve-icon Vulnrichment

Updated: 2026-09-30T13:18:29.478Z

cve-icon NVD

Status : Deferred

Published: 2026-09-30T13:17:29.833

Modified: 2026-09-30T14:18:09.053

Link: CVE-2026-96348

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-30T16:45:17Z

Weaknesses