CVE-2026-91847

Bookly – The Online Scheduling and Appointment Booking System WordPress plugin prior to 28.2 suffers from an IDOR vulnerability in its AI booking-assistant conversation actions. The plugin fails to verify that the requester owns the conversation referenced in unauthenticated endpoints, allowing a...