Executive brief
The Bookly appointment booking plugin for WordPress stores AI conversation transcripts containing sensitive customer data (names, emails, phone numbers, appointment details) without proper access controls. An unauthenticated attacker can read any customer's conversation history and inject malicious messages, potentially compromising customer privacy and allowing manipulation of appointment workflows.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the AI conversation module, where the 'conversation_id' parameter lacks proper authorization validation. Because conversation IDs are sequential integers stored without owner, user, or session identifiers, unauthenticated attackers can enumerate and access any conversation by incrementing the parameter. An attacker can both read full transcripts (leaking PII) and inject arbitrary messages that are replayed to the Cloud AI worker with the complete private conversation history. No authentication is required to exploit this vulnerability.
Affected products
- Bookly Bookly up to and including 28.1
Timeline
- 2026-09-16: disclosed