CVE-2026-93399

CVE-2026-93399 — IDOR en Bookly divulgación de token de pedido y reversión de reservas PoC en Python 3 para CVE-2026-93399 en Bookly bookly-responsive-appointment-booking-tool. Descripción PoCbit / GitHub CVE-2026-93399 — Bookly ≤ 28.2 padece una Referencia Directa a Objeto Insegura CWE-639 en el...

CVE-2026-93399

The Bookly plugin for WordPress (versions up to and including 28.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The issue stems from the bookly_get_form_id handler blindly storing an attacker-controlled order_id into a new booking session. The bookly_render_complete handler the...