Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter
CVSS score
9.1
EPSS probability
%0.4
Risk score
0.0
Published
20 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Bookly <= 28.2 Unauth IDOR + PII Leak + RCE Mass exploitation scanner for CVE-2026-93399 (CVSS 9.1 Critical) affecting the Bookly — Online Scheduling and Appointment Booking System WordPress plugin (versions <= 28.2).
Unauthenticated IDOR in Bookly ≤ 28.2: bookly_get_form_id + bookly_render_complete leak any order’s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC — pocbit.org/pocs/cve-2026-93399
Similar Vulnerabilities
Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter
Online Scheduling and Appointment Booking System <= 27.7 - Unauthenticated Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action
Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data
Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-93399"