{"id":"CVE-2026-12905","title":"The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabin…","summary":"The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabin…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-639"],"published":"2026-08-16","updated":"2026-08-16","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-12905","references":[{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/Ajax.php#L17","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/24.9/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/Ajax.php#L17","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler.php#L82","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/27.7/frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php#L70","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=&old=3637918%40bookly-responsive-appointment-booking-tool&new=3637918%40bookly-responsive-appointment-booking-tool","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/1600466e-ad45-4dc7-916b-6c97301d2b03?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"ingestedAt":"2026-08-16T13:39:06.172Z","epss":0.0029,"epssPercentile":0.21748,"slug":"CVE-2026-12905","body":"## Overview\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}