CVE-2026-103365: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in ladela Online Scheduling and Appointment Booking System – Bookly

The Bookly plugin for WordPress versions up to and including 28.4 contains a sensitive information exposure vulnerability (CWE-200). The endpoint bookly_render_details is accessible without authentication (registered for both wp_ajax and wp_ajax_nopriv) and bypasses CSRF token validation by overriding csrfTokenValid() to always return true. The plugin loads customer data based solely on attacker-supplied phone or email without confirming customer identity. When site owners use certain placeholders in the booking form's Details step, the plugin substitutes stored customer personal data into the returned HTML, enabling unauthorized disclosure of sensitive information.

An unauthenticated attacker who knows a registered customer's primary phone number or email can retrieve that customer's stored personal information including name, email, phone number, and internal notes. This exposure compromises customer privacy but does not allow modification or deletion of data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium impact primarily due to confidentiality loss without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site owners should consider disabling or restricting access to the vulnerable endpoint or removing the affected placeholders from the booking form's Details step to prevent sensitive data disclosure.