CVE-2026-93399

{
  "etk_id": "ETK-2026-200",
  "cve_id": "CVE-2026-93399",
  "display_id": "CVE-2026-93399",
  "ghsa_id": "GHSA-rmc5-xv4j-mvf8",
  "euvd_id": "EUVD-2026-86544",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated insecure direct object reference in Bookly",
  "summary": "Bookly for WordPress through version 28.2 is affected by an insecure direct object reference in several booking AJAX actions. An unauthenticated attacker may access booking and calendar information associated with other orders and delete non-completed bookings. Exploitation requires the affected AJAX endpoints to be reachable and relies on predictable order identifiers.",
  "mitigation": "Update Bookly to a vendor release newer than 28.2 once a verified fix is available. Until then, restrict public access to the affected booking AJAX functionality or disable the plugin if that can be done safely.",
  "vendor": "ladela",
  "product": "Online Scheduling and Appointment Booking System – Bookly",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 28.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Online Scheduling and Appointment Booking System – Bookly",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 9.1,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
  "epss_score": 0.0037,
  "epss_percentile": 0.2952,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 37.96338213333333,
  "t0_at": "2026-09-25T06:39:55.951000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-01T04:18:26.400495+00:00",
      "days": 5.901741313599537,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:39:55.951000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-09-25T00:00:00+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:39:55.951000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-93399"
    },
    "public_poc": {
      "at": "2026-09-25T07:53:19+00:00",
      "days": 0.05096121527777778,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:39:55.951000+00:00",
      "url": "https://github.com/murrez/CVE-2026-93399"
    },
    "trigger_signal": {
      "at": "2026-09-25T00:00:00+00:00",
      "days": -0.2777309143518519,
      "is_lower_bound": false,
      "measured_at": "2026-09-25T06:39:55.951000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-93399"
    }
  }
}