VULNERABILITY INTELLIGENCE

CVE-2026-25194

CVSS score1.8 LOW

EPSS probability0.45%

CISA KEVNot currently listed

Published2026-08-11

Last modified2026-08-12

Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.