CVE-2026-12905 describes an Insecure Direct Object Reference vulnerability in the Bookly plugin for WordPress, specifically in the appointment() method of the Mobile Staff Cabinet API handler. The handler loads appointment data based on attacker-supplied appointment IDs without verifying that the appointment's staff_id matches the authenticated staff member's ID. Other related API operations correctly enforce staff scoping, but this method does not, allowing authenticated staff users to enumerate appointment IDs and access appointment details belonging to other staff members. Exposed data includes internal notes and full customer appointment collections with personal and payment information.

Authenticated staff users with mobile cabinet access can read sensitive appointment and customer data belonging to other staff members. This leads to unauthorized disclosure of personal customer information and payment details. There is no indication of data modification or denial of service impact. The vulnerability has a medium severity rating with a CVSS score of 4.3.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is available at this time. Until a patch is released, restrict staff-level mobile cabinet access to trusted users only and monitor for suspicious activity related to appointment ID enumeration.