{"vulnerability": "cve-2026-93399", "sightings": [{"uuid": "29541ace-ae97-40f2-a890-396fa3db9859", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mwda4ypsys2n", "content": "\ud83d\udd34 CVE-2026-93399 - Critical (9.1)\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-93399/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-25T07:18:31.070485Z"}, {"uuid": "9b49b873-f6f3-435c-9d2a-de9a725867eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mwdczdjcm62o", "content": "CVE-2026-93399\nThe Bookly scheduling plugin for WordPress versions up to 28.2 can be tricked into revealing other customers' booking details and even removing scheduled appointments without any sign\u2011in. This happens because\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-25T08:10:08.675666Z"}, {"uuid": "4f685791-eb05-48fb-8dad-ed720bfe68b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwdjl7agdm2f", "content": "\ud83d\udea8 CVE-2026-93399 \u2014 CVSS 9.1 CRITICAL\n\nThe Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and in...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-93399\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-25T10:07:31.398856Z"}, {"uuid": "3bdc0382-4770-481b-b802-42c0ad674008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93399", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117331212741354088", "content": "CVE-2026-93399 (CRITICAL): Bookly WordPress plugin (\u226428.2) lets unauth'd attackers enumerate, access, and delete bookings via auth bypass in AJAX actions. No patch. Restrict plugin endpoints & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladela-online-scheduling-437a419f1c3d5ec6 #OffSeq #WordPress #Vuln #Cybersecurity", "creation_timestamp": "2026-09-25T10:30:26.651338Z"}, {"uuid": "b9dbda24-5179-4cc1-851f-7989bf0027ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-93399", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mwdkuaths22m", "content": "Bookly plugin for WordPress (\u226428.2) has a CRITICAL auth bypass (CVE-2026-93399). Unauth'd attackers can access & delete bookings. No patch \u2014 restrict plugin access & monitor for abuse. https://radar.offseq.com/threat/cve-2026-93399-cwe-639-authorization-bypass-through-user-controlled-key-in-ladel...", "creation_timestamp": "2026-09-25T10:30:28.567776Z"}, {"uuid": "f62dd004-4540-4b33-8571-417438f31b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "https://t.me/GithubRedTeam/103313", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T08:00:08.000000Z"}, {"uuid": "1be4fcb6-1341-4f4c-99d8-0c6dd5c708ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "content": "", "creation_timestamp": "2026-09-25T11:00:13.000000Z"}, {"uuid": "07c2c9d2-c8db-420d-ba17-89f97f258257", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "seen", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}, {"uuid": "0e38545d-4fa4-4ec9-843a-549f241e477b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/103313", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-93399\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a murrez\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 07:53:48\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated IDOR in Bookly \u2264 28.2: bookly_get_form_id + bookly_render_complete leak any order\u2019s bookly_order token; bookly_add_to_calendar exposes appointments; bookly_rollback_order cancels/deletes non-completed bookings. CVSS 9.1. Python check/exploit PoC \u2014 pocbit.org/pocs/cve-2026-93399\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-25T08:00:08.000000Z"}, {"uuid": "34196503-4564-4c8c-b4c7-ddeaded6012a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "published-proof-of-concept", "source": "Telegram/AEwUmxTHfjK52gcCzirRg3eKj4ECkiyGcn3Hrgzjr8KwPNw", "content": "", "creation_timestamp": "2026-09-25T11:00:13.000000Z"}, {"uuid": "f9dbff0d-d4ac-4c81-ad1f-20b963060f73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-93399", "type": "published-proof-of-concept", "source": "Telegram/7GNnqmv7ZdPg7QLWL60eVt3b44pjSw_GS68UUpuiTX3oD9k", "content": "", "creation_timestamp": "2026-09-25T15:00:07.000000Z"}]}