CVE-2026-12626: CWE-502 Deserialization of Untrusted Data in ladela Online Scheduling and Appointment Booking System – Bookly
Description
The Online Scheduling and Appointment Booking System – Bookly WordPress plugin is vulnerable to PHP Object Injection via deserialization of untrusted data in the 'value' parameter. This affects all versions up to and including 28.2. The vulnerability requires authenticated attackers with custom-level access or higher. No known exploit gadget chain is currently available. The vulnerability has a high severity rating with a CVSS score of 7.2.
CVSS v3.1
Score 7.2high
Affected software
ladela
Online Scheduling and Appointment Booking System – Bookly
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-12626 describes a PHP Object Injection vulnerability in the Bookly plugin for WordPress, caused by unsafe deserialization of untrusted input via the 'value' parameter. This vulnerability affects all versions up to and including 28.2. An attacker with authenticated custom-level access or higher can inject a PHP object, potentially leading to full confidentiality, integrity, and availability compromise. However, no known gadget chain for exploitation has been identified at this time.
Potential Impact
Successful exploitation could allow an authenticated attacker with custom-level access or above to execute arbitrary PHP objects, potentially resulting in full system compromise including confidentiality, integrity, and availability impacts. The CVSS score of 7.2 reflects a high severity risk. No known exploits are currently in the wild.
Mitigation Recommendations
No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to trusted users only and monitor for suspicious activity related to deserialization inputs.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-18T14:40:59.125Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac9e3642cdf04f6560f7826
Added to database: 10/10/2026, 07:04:04 UTC
Last enriched: 10/10/2026, 07:18:29 UTC
Last updated: 10/10/2026, 21:27:04 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.