CVE-2026-86837 — Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

CVE-2026-86837

Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass PUBLISHED

Description (CNA)

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

Affected (CNA)

Vendor / product	Versions
Unknown / Bookly	affected 0 before 28.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/5bfed7cf-5bf3-4a3b-a2b6-9f9d48f52fd5/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.