Bookly WordPress Plugin IDOR Lets Attackers Access and Delete Bookings

The Bookly plugin for WordPress is vulnerable to an Insecure Direct Object Reference in versions up to and including 28.2. The flaw affects the AJAX actions bookly_get_form_id, bookly_render_complete, bookly_add_to_calendar, and bookly_rollback_order.

The bookly_get_form_id handler blindly stores the attacker-controlled order_id from submitted form_data into a new booking session. The bookly_render_complete handler then trusts that session to look up and return the corresponding Order's secret token without verifying that the current session created that order.

This makes it possible for unauthenticated attackers to:

• Enumerate sequential order IDs
• Disclose other customers' order tokens
• Retrieve calendar/appointment information via bookly_add_to_calendar
• Permanently delete arbitrary non-completed bookings via bookly_rollback_order, which cascade-deletes the customer_appointment and, when no other customers are attached, the underlying appointment