CVE-2026-104898 | CVSS: 6.8 | 严重级别: MEDIUM
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the WordPress account binding of any Bookly staff record, including those owned by administrators, effectively hijacking a higher-privileged staff member's account association and escalating privileges. Exploitation requires the att
参考链接:
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking
📌 数据来源: NVD 官方