CVE-2026-86841 PUBLISHED

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

Assigner: WPScan
Reserved: 08.09.2026 Published: 27.09.2026 Updated: 27.09.2026

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.

Product Status

Vendor Unknown
Product Online Scheduling and Appointment Booking System
Versions Default: unaffected
  • affected from 23.2 to 28.3 (excl.)

Credits

  • Muni Nitish Kumar Yaddala finder
  • WPScan coordinator

References

Problem Types

  • CWE-502 Deserialization of Untrusted Data CWE