{"id":"CVE-2026-96348","published":"2026-09-30T13:17:29.833","lastModified":"2026-09-30T14:18:09.053","description":"Unauthenticated Broken Access Control in Bookly <= 28.2 versions.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookly-responsive-appointment-booking-tool/vulnerability/wordpress-bookly-plugin-28-2-broken-access-control-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Bookly plugin allows unauthenticated users to bypass access controls and modify data through a broken access control vulnerability. This means attackers can perform actions they shouldn't be able to without needing to authenticate first.","exploitability":"Exploitation is straightforward with no authentication required, though it may need knowledge of specific API endpoints or parameters to trigger the access control bypass effectively.","blast_radius":"The impact could be significant as attackers can modify booking data, potentially leading to double-booking, unauthorized changes, or manipulation of reservation information without any authentication.","remediation":"Upgrade to version 28.3 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["access-control","web","plugin","bookly"],"model":"garnet-coder","analyzedAt":"2026-10-17T09:05:16.256Z"}}