EUVD-2026-86621

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

CVE-2026-86837: Authorization Bypass Through User-Controlled Key

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address...

PT-2026-98418

Name of the Vulnerable Software and Affected Versions Bookly WordPress plugin versions prior to 28.3 Description An issue exists where the software fails to properly verify a customer's identity before updating stored details. This allows unauthenticated attackers who possess a customer's primary...