Descripción
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the -tips- parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the -tips- parameter, causing the total price to be reduced to zero.
CVSS 5.3EPSS 0.45199999999999996%Riesgo 0.55
Ver fuente- Publicación
- 2026-04-09 13:16:42
- Versiones afectadas
- <=27.0
- Tipo
- Installed app
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N