# CVE-2026-12626: Bookly plugin for WordPress PHP Object Injection

Source: https://junglewise.ai/threats/cve-2026-12626-the-online-scheduling-and-appointment-booking-system-bookly  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-10. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-12626 · Severity: high · CVSS 7.2 · Published 2026-10-10

The Bookly plugin for WordPress is an online scheduling and appointment booking system. A PHP Object Injection vulnerability allows authenticated users with custom-level access or higher to inject malicious PHP objects through the deserialization of untrusted input. While no active gadget chain is currently available to attackers, this vulnerability could potentially be chained with other flaws to achieve arbitrary code execution and compromise the WordPress site.

Technologies: [Bookly](https://junglewise.ai/threats/technologies/bookly). Vendors: [Bookly](https://junglewise.ai/threats/vendors/bookly).

## Quick answers

**Is CVE-2026-12626 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12626 being exploited in the wild.

**How severe is CVE-2026-12626?** High severity, with a CVSS score of 7.2, published 10 October 2026.

**Which products and versions are affected?** Bookly up to 28.2.

**Is there a fix for CVE-2026-12626?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12626 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12626?** Check whether you run Bookly at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the 'value' parameter, which deserializes untrusted input without proper validation. Authenticated attackers with custom-level access and above can inject arbitrary PHP objects. The attack requires authentication and elevated privileges; however, no known gadget chain is publicly available at this time that would allow direct remote code execution.

## Affected products

- Bookly Bookly up to 28.2

## Timeline

- 2026-10-10: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3707284/bookly-responsive-appointment-booking-tool](https://plugins.trac.wordpress.org/changeset/3707284/bookly-responsive-appointment-booking-tool)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99623b?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99623b?source=cve)

## Related threats

- [Bookly broken access control in appointment booking](https://junglewise.ai/threats/cve-2026-96348-unauthenticated-broken-access-control-in-bookly-28-2-versions)
- [Bookly Insecure Direct Object References (IDOR) in Subscriber access](https://junglewise.ai/threats/cve-2026-96347-subscriber-insecure-direct-object-references-idor-in-bookly-28-2)
- [Bookly WordPress plugin payment bypass via booking price manipulation](https://junglewise.ai/threats/cve-2026-86838-the-bookly-wordpress-plugin-before-28-3-does-not-validate-client)
- [Bookly Insecure Direct Object Reference in AJAX handlers](https://junglewise.ai/threats/cve-2026-93399-the-bookly-plugin-for-wordpress-is-vulnerable-to-insecure-direct)
- [Bookly appointment booking plugin IDOR in AI assistant conversations](https://junglewise.ai/threats/cve-2026-91847-the-online-scheduling-and-appointment-booking-system-wordpress)