CVE-2026-890637.5HighCWE-639

CVE-2026-89063: Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via 'conversation_id' Parameter

ladela · Online Scheduling and Appointment Booking System – Bookly

Affected: ladela Online Scheduling and Appointment Booking System – Bookly · Exploitation: check available, not yet exploited

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.6%probability of exploitation in the next 30 days

76th percentile

050100

Higher than 76% of scored CVEs

7.5HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to read the full AI booking conversation transcript of any customer — leaking names, email addresses, phone numbers, and appointment details echoed by the assistant — and inject arbitrary messages into any victim conversation that are subsequently replayed to the Cloud AI worker along with the full private history. Because AI conversations are stored with no owner, user, or session identifier and conversation IDs are sequential integers, an unauthenticated attacker can enumerate all customer conversations simply by incrementing the conversation_id parameter.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

ladela · Online Scheduling and Appointment Booking System – Booklyup to and including 28.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Check available, not yet exploited. A public nuclei template can confirm it on a system you are authorised to test.
CISA KEV: Not listed
Public check: Bookly <=28.1 - IDOR Unauthenticated Sensitive Data Access · nuclei template in projectdiscovery/nuclei-templates
Weakness: Insecure Direct Object Reference
Vendor: ladela
Published: September 2026
Band: Check available, not yet exploited, September 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-89063 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.