CVE-2026-2520 describes a missing authorization vulnerability (CWE-862) in the Online Scheduling and Appointment Booking System – Bookly WordPress plugin. The 'updateAddon' function lacks proper capability checks, enabling authenticated users with low privileges (Subscriber-level and above) to update plugins that have a main file named 'main.php'. This could lead to unauthorized modification of plugin code or behavior. The vulnerability affects all versions up to and including 27.2. No official patch or remediation level has been provided yet, and no known exploits are reported in the wild.

Authenticated users with Subscriber-level privileges or higher can update plugins with a main file named 'main.php' without proper authorization. This unauthorized update capability can lead to integrity issues of plugins, potentially allowing attackers to modify plugin functionality or introduce malicious code. The vulnerability does not impact confidentiality but affects integrity and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and permissions to trusted users only and monitor plugin updates carefully. Avoid granting Subscriber-level or higher access to untrusted users.