CVE-2026-93399 is an authorization bypass vulnerability (CWE-639) in the Bookly WordPress plugin (versions up to 28.2). The issue stems from the 'bookly_get_form_id' AJAX handler storing an attacker-controlled 'order_id' in the booking session without verifying that the session owns the order. Subsequently, the 'bookly_render_complete' handler uses this session data to retrieve the corresponding order's secret token without proper authorization checks. This flaw enables unauthenticated attackers to enumerate sequential order IDs, disclose secret tokens of other customers' orders, access calendar and appointment details via 'bookly_add_to_calendar', and permanently delete arbitrary non-completed bookings through 'bookly_rollback_order', which also deletes associated customer appointments and potentially the underlying appointment if no other customers remain attached.

The vulnerability allows unauthenticated attackers to bypass authorization controls, leading to disclosure of sensitive order tokens, unauthorized access to calendar and appointment information, and permanent deletion of non-completed bookings and associated appointments. This compromises the integrity and availability of the booking system and exposes customer data without requiring authentication.

No official patch or fix is currently provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX actions if possible and monitor for suspicious activity related to booking manipulation. Avoid exposing the affected plugin versions in public-facing environments.