Is CVE-2026-86841 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86841 being exploited in the wild.

How severe is CVE-2026-86841?

Informational severity, published 27 September 2026.

Which products and versions are affected?

Bookly responsive appointment booking tool 23.2 to 28.2.

Is there a fix for CVE-2026-86841?

A patch was published on 2026-09-27: Fixed in version 28.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-86841 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-86841?

Check whether you run Bookly responsive appointment booking tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86841: Bookly plugin PHP object injection in diagnostics

CVE-2026-86841 · Severity: info · Published 2026-09-27

Bookly is a WordPress plugin that manages appointment bookings and scheduling for service providers. A user with a custom booking-management capability granted by an administrator can inject malicious PHP code through the diagnostics feature, potentially allowing them to modify site settings, read stored API credentials, and take over the site. The vulnerability requires the administrator to explicitly assign a specific user role, but an attacker with that role can escalate to full site compromise.

Vendors: Bookly.

Quick answers

Is CVE-2026-86841 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86841 being exploited in the wild.
How severe is CVE-2026-86841?: Informational severity, published 27 September 2026.
Which products and versions are affected?: Bookly responsive appointment booking tool 23.2 to 28.2.
Is there a fix for CVE-2026-86841?: A patch was published on 2026-09-27: Fixed in version 28.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86841 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-86841?: Check whether you run Bookly responsive appointment booking tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to validate deserialization of untrusted input in its diagnostics advanced options feature and does not properly restrict access to this maintenance function to administrators only. An attacker with a custom booking-management capability can exploit PHP object injection (CWE-502) to instantiate arbitrary objects, overwrite site options, and exfiltrate integration secrets. Network access and pre-assigned privileges are required, but the vulnerability is fixed in version 28.3.

Affected products

Bookly Bookly responsive appointment booking tool 23.2 to 28.2

Timeline

2026-09-25: disclosed
2026-09-27: patched: Fixed in version 28.3

References

https://wpscan.com/vulnerability/2150717e-7564-4b29-b2e7-362dd3b480c3/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.