CVE-2026-12905

The Bookly plugin for WordPress has a security flaw in versions up to 27.7. Specifically, the plugin's Mobile Staff Cabinet API can be tricked into revealing sensitive information about appointments not assigned to the authenticated staff member. This occurs because the plugin doesn't properly verify the staff ID associated with an appointment, allowing attackers to access appointment details, including internal notes and customer information, by guessing sequential appointment IDs.

Based on public CVE data (MITRE/NVD).