Bookly WordPress Plugin IDOR in AJAX Order Handlers

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to the 'bookly_get_form_id' handler blindly storing the attacker-controlled 'order_id' from the submitted form_data into a new booking session, which the 'bookly_render_complete' handler then trusts to look up and return the corresponding Order's secret token without verifying that the current session created that order. This makes it possible for unauthenticated attackers to enumerate sequential order IDs, disclose other customers' order tokens, retrieve calendar/appointment information via 'bookly_add_to_calendar' and permanently delete arbitrary non-completed bookings via 'bookly_rollback_order', which cascade-deletes the customer_appointment and (when no other customers are attached) the underlying appointment.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Bookly plugin for WordPress versions up to 28.2 contains a critical Insecure Direct Object Reference (IDOR) vulnerability affecting multiple AJAX actions: 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar', and 'bookly_rollback_order'. The vulnerability stems from improper authorization checks where user-supplied order IDs are directly stored and trusted without validation, allowing attackers to access, modify, or manipulate booking records belonging to other users. With a CVSS score of 9.1, this affects all WordPress installations using Bookly, impacting appointment booking systems across thousands of small businesses, salons, clinics, and service providers who rely on this popular plugin.

Casky's 283 matching security skills leverage Claude AI with extended reasoning to detect the attack chain spanning Privilege Escalation (TA0004) and Credential Access (TA0006). Practitioners using Casky would identify suspicious patterns including: unauthenticated or improperly scoped AJAX requests to booking endpoints with sequential or enumerated order IDs, access to booking details outside the requestor's authorization scope, and session manipulation attempts where attacker-controlled 'order_id' parameters persist across requests. The platform would flag authorization bypass attempts in form data submission, detect when arbitrary order records are retrieved without proper ownership verification, and correlate these indicators with CWE-639 (Authorization Bypass) patterns, surfacing findings that show how attackers systematically enumerate and exfiltrate booking information or manipulate orders without legitimate access rights.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93399.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-93399

Casky has 283 skills that investigate the attack patterns behind CVE-2026-93399. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn