josemour8/CVE-2026-93399

PoC

Bookly <= 28.2 Unauth IDOR + PII Leak + RCE Mass exploitation scanner for CVE-2026-93399 (CVSS 9.1 Critical) affecting the Bookly — Online Scheduling and Appointment Booking System WordPress plugin (versions <= 28.2).

view exploit source poc_in_githubauthor josemour8published 2026-09-26catalog poc_in_github
01

exploited CVEs (1)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-93399UScritical9.1Exploit
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bo…
scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.

Free scan