CVE-2026-86841 — Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

CVE-2026-86841

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options PUBLISHED

Description (CNA)

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.

Affected (CNA)

Vendor / product	Versions
Unknown / Online Scheduling and Appointment Booking System	affected 23.2 before 28.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2150717e-7564-4b29-b2e7-362dd3b480c3/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.