Executive brief
Bookly is a popular WordPress plugin for scheduling appointments and managing bookings. A flaw allows attackers with basic subscriber-level access to update any plugin with a main file named 'main.php' to its latest version without authorization, potentially replacing plugins with malicious versions and compromising site security.
Technical details
The vulnerability is an authorization bypass caused by a missing capability check in the 'updateAddon' function within the PluginsUpdater component. Authenticated users with Subscriber-level privileges or higher can call this function to update any plugin whose main file is named 'main.php' to an arbitrary version without proper permission validation. This allows authenticated attackers to perform unauthorized plugin updates, potentially installing compromised or malicious plugin versions. The vulnerability affects all versions of Bookly up to and including 27.2, and a patch should be available in later versions.
Affected products
- Automattic Bookly up to 27.2
Timeline
- 2026-09-08: disclosed