Vulnerability · Published Sep 27, 2026 · Assigned by WPScan

CVE-2026-86841Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

Medium 4.7

In plain English

A medium-severity unsafe deserialization in Online Scheduling and Appointment Booking System from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)4.7Medium

Exploit odds (30 days)0.2%top 87.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Online Scheduling and Appointment Booking System	23.2 – before 28.3

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References

https://wpscan.com/vulnerability/2150717e-7564-4b29-b2e7-362dd3b480c3/ exploit, vdb-entry, technical-description