CVE-2026-86838

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...

CVE-2026-86838

The Bookly WordPress plugin before version 28.3 is vulnerable to an unauthenticated payment bypass . The root cause is a lack of server-side validation for client-supplied booking quantity values during the calculation of the appointment total. This allows unauthenticated users to manipulate the ...

CVE-2026-86838: External Control of Assumed-Immutable Web Parameter

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step...