CVE-2026-12905 describes an insecure direct object reference vulnerability in the Bookly plugin for WordPress, specifically in the appointment() method of the Mobile Staff Cabinet API handler. The vulnerability arises because the handler loads appointment data based on an attacker-controlled parameter without verifying that the appointment belongs to the authenticated staff member. This allows authenticated staff users with valid access_key tokens to enumerate appointment IDs and access sensitive appointment and customer data belonging to other staff members. Other API operations correctly enforce staff scoping, but this method does not, leading to an authorization bypass.

An attacker with staff-level authenticated access to the mobile staff cabinet can read sensitive appointment details of other staff members. This includes internal notes and comprehensive customer appointment data such as full names, emails, phone numbers, notes, custom fields, extras, and payment information (total, type, status). There is no indication of data modification or denial of service impact. The confidentiality of customer and appointment data is compromised, but integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict staff-level access to trusted users only and monitor for suspicious enumeration of appointment IDs. Avoid exposing access_key tokens broadly. Follow vendor updates for a security patch addressing this authorization bypass.