CVE-2026-12905

The CVE-2026-12905 entry concerns the Bookly WordPress plugin (up to version 27.7). Affected component is the Mobile Staff Cabinet API, specifically appointment() in Handler1_0.php. The vulnerability is an Insecure Direct Object Reference: attacker-supplied params[id] load appointments without ve...