CVE-2026-91847 — Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR

CVE-2026-91847

Bookly < 28.2 - Unauthenticated AI Assistant Conversation Disclosure and Message Injection via IDOR PUBLISHED

Description (CNA)

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and to inject messages into their in-progress conversation.

Affected (CNA)

Vendor / product	Versions
Unknown / Online Scheduling and Appointment Booking System	affected 28.1 before 28.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/9eef3086-3a67-4ee2-bd78-e346e7b05d62/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.