Executive brief
Bookly is a popular WordPress plugin used for managing appointments and service bookings. A critical security flaw allows an unauthenticated attacker to interact directly with the website's database. This could lead to the theft of sensitive customer information, unauthorized access to administrative data, or disruption of the booking service.
Technical details
An unauthenticated SQL injection vulnerability exists in the Bookly plugin for WordPress (versions 27.7 and below). The flaw is caused by improper neutralization of special elements used in an SQL command (CWE-89). A remote, unauthenticated attacker can exploit this by sending specially crafted network requests to the affected WordPress site. Successful exploitation allows the attacker to read sensitive data from the database, potentially leading to full site compromise. The issue is resolved in version 27.8.
Affected products
- Bookly Bookly <= 27.7
Timeline
- 2026-05-08: other: Reported by researcher dodoh4t
- 2026-07-16: advisory: Patchstack advisory published
- 2026-07-23: disclosed: CVE published to NVD
- 2026-07-23: patched: Version 27.8 released to address the vulnerability