{"vulnerability": "CVE-2026-93399", "sightings": [{"uuid": "29541ace-ae97-40f2-a890-396fa3db9859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwda4ypsys2n", "content": "\ud83d\udd34 CVE-2026-93399 - Critical (9.1)\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93399/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T07:18:31.070485Z"}, {"uuid": "9b49b873-f6f3-435c-9d2a-de9a725867eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwdczdjcm62o", "content": "CVE-2026-93399\nThe Bookly scheduling plugin for WordPress versions up to 28.2 can be tricked into revealing other customers' booking details and even removing scheduled appointments without any sign\u2011in. This happens because\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-25T08:10:08.675666Z"}, {"uuid": "4f685791-eb05-48fb-8dad-ed720bfe68b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwdjl7agdm2f", "content": "\ud83d\udea8 CVE-2026-93399 \u2014 CVSS 9.1 CRITICAL\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93399\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T10:07:31.398856Z"}, {"uuid": "3bdc0382-4770-481b-b802-42c0ad674008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93399", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117331212741354088", "content": "CVE-2026-93399 (CRITICAL): Bookly WordPress plugin (\u226428.2) lets unauth'd attackers enumerate, access, and delete bookings via auth bypass in AJAX actions. No patch. Restrict plugin endpoints & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladela-online-scheduling-437a419f1c3d5ec6 #OffSeq #WordPress #Vuln #Cybersecurity", "creation_timestamp": "2026-09-25T10:30:26.651338Z"}, {"uuid": "b9dbda24-5179-4cc1-851f-7989bf0027ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93399", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwdkuaths22m", "content": "Bookly plugin for WordPress (\u226428.2) has a CRITICAL auth bypass (CVE-2026-93399). Unauth'd attackers can access & delete bookings. No patch \u2014 restrict plugin access & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladel...", "creation_timestamp": "2026-09-25T10:30:28.567776Z"}]}