CVE-2026-12626

Published: Oct 10, 2026Modified: Oct 13, 2026Deferred

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: security@wordfence.com (Secondary)

Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.

Related CWEs

CWE-502

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://plugins.trac.wordpress.org/changeset/3707284/bookly-responsive-appointment-booking-tool

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99623b?source=cve

Source: security@wordfence.com

Timeline

No history available yet.