VULNERABILITY INTELLIGENCE

CVE-2026-12626

CVSS score7.2 HIGH

EPSS probability0.25%

CISA KEVNot currently listed

Published2026-10-10

Last modified2026-10-13

Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level …