{"id":"CVE-2026-2520","aliases":["EUVD-2026-72701","GHSA-pqcg-gw2f-rqp8"],"status":"published","title":"Online Scheduling and Appointment Booking System – Bookly \u003c= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update","description":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0038,"percentile":0.32307,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-09-08T11:30:01Z","modified":"2026-09-08T13:17:18Z","products":[{"vendor":"ladela","product":"online scheduling and appointment booking system – bookly"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/b7edc69b-363d-49df-b82b-a9ad4fe9224a?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/PluginsUpdater.php#L105"},{"url":"https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/PluginsUpdater.php#L10"},{"url":"https://plugins.trac.wordpress.org/changeset/3504922/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2520"},{"url":"https://plugins.trac.wordpress.org/changeset/3504922"},{"url":"https://github.com/advisories/GHSA-pqcg-gw2f-rqp8"}],"sources":{"cve":[{"id":"CVE-2026-2520","title":"Online Scheduling and Appointment Booking System – Bookly \u003c= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update","description":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.","status":"published","published":"2026-09-08T11:30:01.269Z","modified":"2026-09-08T12:01:15.828Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:48:46.911326Z"}],"euvd":[{"id":"EUVD-2026-72701","description":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.","status":"published","published":"2026-09-08T11:30:01Z","modified":"2026-09-08T12:01:15Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:28:29.861344Z"}],"ghsa":[{"id":"GHSA-pqcg-gw2f-rqp8","title":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable...","description":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.","status":"published","published":"2026-09-08T12:31:30Z","modified":"2026-09-08T12:31:35Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:28.397774Z"}],"nvd":[{"id":"CVE-2026-2520","description":"The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.","status":"published","published":"2026-09-08T12:16:54.067Z","modified":"2026-09-08T13:17:18.997Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:44.436435Z"}]}}