Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access CVE-2026-89063
- Severity
- EPSS Score
- EPSS Percentile
- Vulnerability description
- Not available
- Risk description
- Not available
- Recommendation
- Not available
- References
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/bookly-responsive-appointment-booking-tool/online-scheduling-and-appointment-booking-system-281-insecure-direct-object-reference-to-unauthenticated-sensitive-data-access-and-message-injection-via-conversation-id-parameterhttps://www.cve.org/CVERecord?id=CVE-2026-89063
- Codename
- Not available
- Detectable with
- Network Scanner
- Scan engine
- Nuclei
- Cisa Kev
- No
- Exploitable with Sniper
- No
- CVE Published
- Sep 16, 2026
- Detection added at
- Software Type
- Not available
- Vendor
- bookly
- Product
- bookly-responsive-appointment-booking-tool
Detect this vulnerability now!
Check your clients' targets (or your own) for this vulnerability and thousands more! Get proof for validation with our ethical hacking toolkit.