CVE-2026-92799 describes an authorization bypass vulnerability in the Bookly WordPress plugin versions up to 28.2. The vulnerability arises because the `postValidateCustomer()` function uses a loose PHP inequality operator (`!=`) to compare a session-stored one-time verification code (a non-zero integer) against an attacker-supplied `verification_code` parameter. Due to PHP type juggling, submitting a JSON boolean `true` as the verification code satisfies the loose comparison, bypassing the check. Additionally, the booking AJAX controller registers all methods as `wp_ajax_nopriv_` handlers and overrides `csrfTokenValid()` to always return true, leaving the endpoint unauthenticated and unprotected against CSRF. This combination enables unauthenticated attackers to overwrite the name, email, phone, and address fields of any existing Bookly customer record, redirecting booking notifications to attacker-controlled contacts.

An unauthenticated attacker can bypass the phone/email verification step and modify arbitrary customer records in the Bookly plugin, potentially redirecting booking notifications to attacker-controlled contact details. This impacts the integrity of customer data and notification delivery but does not affect confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoints and consider disabling the plugin or its booking features if feasible. Monitor for updates from the vendor regarding an official fix.