CVE-2026-89063

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to an insecure direct object reference in all versions up to and including 28.1, via the 'conversation_id' parameter, which has no ownership, user, or session validation and uses sequential integer IDs. Any unauthenticated attacker can enumerate every customer conversation simply by incrementing the parameter and read full AI booking transcripts, leaking names, email addresses, phone numbers, and appointment details echoed by the assistant. Attackers can additionally inject arbitrary messages into any victim's conversation, which are subsequently replayed to the Cloud AI worker along with the victim's complete private history, enabling manipulated or phishing-style bookings. Any WordPress site running Bookly 28.1 or earlier with the AI booking conversation feature in use is affected. No public proof-of-concept exists and the flaw is not in CISA's KEV, so exploitation is currently none known.

What to do: Update to the latest Bookly release immediately (any patched version above 28.1), or disable the AI booking assistant feature until the update is applied. Review web server and plugin logs for unauthenticated requests iterating sequential conversation_id values, and audit stored AI transcripts for unexpected injected messages. Because customer names, emails, phone numbers, and appointment details may have been exposed, assess breach-notification obligations for affected individuals.