WordPress security changelog
HIGH CVE-2026-42667 Deferred

Bookly: A security weakness

Bookly is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 27.4.

CVE / CNA score 7.5 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Bookly
Plugin slug
bookly-responsive-appointment-booking-tool
Affected
n/a through 27.4
Safe version
27.5
Published
Jun 15, 2026
Weakness
CWE-201 — Insertion of Sensitive Information Into Sent Data

This CVE was published Jun 15, 2026 and is one of 8 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Bookly to 27.5 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

Unauthenticated Sensitive Data Exposure in Bookly <= 27.4 versions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources