Online Scheduling and Appointment Booking System – Bookly: A security weakness

Online Scheduling and Appointment Booking System – Bookly is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 27.0.

CVE / CNA score 5.3 CVSS 3.1 · security@wordfence.com

NVD score Pending NVD has not published its own CVSS assessment.

Component: Online Scheduling and Appointment Booking System – Bookly
Plugin slug: bookly-responsive-appointment-booking-tool
Affected: <= 27.0
Safe version: > 27.0
Published: Apr 09, 2026
Weakness: CWE-472 — External Control of Assumed-Immutable Web Parameter

This CVE was published Apr 09, 2026 and is one of 8 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Online Scheduling and Appointment Booking System – Bookly to a release after 27.0, or disable and remove it until a fixed version is available.

Source record

Technical description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

Patch or disable the affected component.

Technical description

Primary and upstream sources