CVE-2026-61949
Bookly plugin versions 27.7 and earlier contain an unauthenticated SQL injection flaw. The vulnerability can be triggered over the network without any user credentials and allows attackers to read or modify the database. It poses a serious risk to the confidentiality of data stored by the plugin.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
WordPress sites that use the Bookly booking plugin, specifically versions 27.7 and earlier.
Real-world impact
An attacker could extract sensitive information such as customer details, booking records, or even alter or delete data, potentially disrupting the operation of the website.
Why this severity
The CVSS score of 9.3 reflects a remote, unauthenticated attack that can fully compromise data confidentiality. The low attack complexity and lack of required privileges make it easy to exploit, while the impact on availability is limited.
What to do about it
- ›Upgrade to a version newer than 27.7 when it becomes available, or disable the Bookly plugin until a patch is released.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources