HIGH 7.2 NVD
CVE-2026-12626
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.
References
- https://plugins.trac.wordpress.org/changeset/3707284/bookly-responsive-appointment-booking
- https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99
This high severity vulnerability with a CVSS score of 7.2 was published on 2026-10-10 via NVD.
vulnfeed aggregates 13827 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.