Bookly exposes unauthenticated SQL injection through a two-request booking chain
Bookly permits an unauthenticated attacker to seed a booking session through the bookly_get_form_id action with malicious staff_ids values and then invoke bookly_render_time, causing those values to reach the Slots Finder's raw staff_id IN (...) SQL list. Neither request has a nonce or authentication barrier, and the resulting time-based SQL injection can extract sensitive database information. The CNA record lists versions through 27.5 as affected; however, official WordPress.org source for 27.6 and 27.7 retains the vulnerable flow, while 27.8 is the first tag that casts staff IDs to integers in both ChainItem::setStaffIds() and Finder.
- Component
- Online Scheduling and Appointment Booking System – Bookly
- Plugin slug
bookly-responsive-appointment-booking-tool- Affected
- <= 27.5
- Safe version
27.8- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 9 known issues for this plugin.
Update, patch or deactivate.
Update Bookly to 27.8 or later. Review database, web and booking-session logs for suspicious bookly_get_form_id and bookly_render_time request chains and investigate the site if exploitation is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a two-request chain: an attacker first calls the unauthenticated bookly_get_form_id action to seed a booking session carrying malicious staff_ids values, then triggers bookly_render_time to cause the tainted array to reach the vulnerable query; CSRF/nonce validation is absent on both endpoints, meaning this chain can be initiated cross-site.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N