CVE-2026-2519 describes a vulnerability in the ladela Online Scheduling and Appointment Booking System – Bookly WordPress plugin. The flaw arises from the plugin's failure to validate the 'tips' parameter on the server side, allowing unauthenticated attackers to submit negative values. This external control of an assumed-immutable parameter enables attackers to manipulate the total price calculation, effectively reducing it to zero. The vulnerability affects all versions up to 27.0. There is no vendor-provided patch or official remediation information available at this time. The CVSS score of 5.3 reflects a medium severity impact with no confidentiality or availability impact but with integrity impact due to price manipulation.

The vulnerability allows unauthenticated attackers to manipulate the total price by submitting negative values in the 'tips' parameter, potentially bypassing payment requirements or causing financial loss to merchants using the plugin. There is no impact on confidentiality or availability reported. The integrity of the pricing calculation is compromised, which can lead to unauthorized price reductions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing server-side validation for the 'tips' parameter to reject negative values or disable the tips feature if possible. Monitoring for suspicious transactions related to price anomalies may also help mitigate risk.