CVE-2026-93399

The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from the bookly_get_form_id handler blindly storing an attacker-controlled order_id into a new booking session. The bookly_render_complete handler the...