https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 09:05:23 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93399 <p>The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the &#39;bookly_get_form_id&#39;, &#39;bookly_render_complete&#39;, &#39;bookly_add_to_calendar&#39; and &#39;bookly_rollback_order&#39; AJAX actions. This is due to the &#39;bookly_get_form_id&#39; handler blindly storing the attacker-controlled &#39;order_id&#39; from the submitted form_data into a new booking session, which the &#39;bookly_render_complete&#39; handler then trusts to look up and return the corresponding Order&#39;s secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers&#39; order tokens, retrieve calendar/appointment information via &#39;bookly_add_to_calendar&#39; and permanently delete arbitrary non-completed bookings via &#39;bookly_rollback_order&#39;, which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.</p> <p>The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the &#39;bookly_get_form_id&#39;, &#39;bookly_render_complete&#39;, &#39;bookly_add_to_calendar&#39; and &#39;bookly_rollback_order&#39; AJAX actions. This is due to the &#39;bookly_get_form_id&#39; handler blindly storing the attacker-controlled &#39;order_id&#39; from the submitted form_data into a new booking session, which the &#39;bookly_render_complete&#39; handler then trusts to look up and return the corresponding Order&#39;s secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers&#39; order tokens, retrieve calendar/appointment information via &#39;bookly_add_to_calendar&#39; and permanently delete arbitrary non-completed bookings via &#39;bookly_rollback_order&#39;, which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-93399 https://vulnerability.circl.lu/vuln/ghsa-rmc5-xv4j-mvf8 <p>The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the &#39;bookly_get_form_id&#39;, &#39;bookly_render_complete&#39;, &#39;bookly_add_to_calendar&#39; and &#39;bookly_rollback_order&#39; AJAX actions. This is due to the &#39;bookly_get_form_id&#39; handler blindly storing the attacker-controlled &#39;order_id&#39; from the submitted form_data into a new booking session, which the &#39;bookly_render_complete&#39; handler then trusts to look up and return the corresponding Order&#39;s secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers&#39; order tokens, retrieve calendar/appointment information via &#39;bookly_add_to_calendar&#39; and permanently delete arbitrary non-completed bookings via &#39;bookly_rollback_order&#39;, which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.</p> <p>The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the &#39;bookly_get_form_id&#39;, &#39;bookly_render_complete&#39;, &#39;bookly_add_to_calendar&#39; and &#39;bookly_rollback_order&#39; AJAX actions. This is due to the &#39;bookly_get_form_id&#39; handler blindly storing the attacker-controlled &#39;order_id&#39; from the submitted form_data into a new booking session, which the &#39;bookly_render_complete&#39; handler then trusts to look up and return the corresponding Order&#39;s secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers&#39; order tokens, retrieve calendar/appointment information via &#39;bookly_add_to_calendar&#39; and permanently delete arbitrary non-completed bookings via &#39;bookly_rollback_order&#39;, which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.</p> https://vulnerability.circl.lu/vuln/ghsa-rmc5-xv4j-mvf8