Threats tagged 'ghsa-5p6p-rjcr-26xj'

CVE-2026-103365 is a medium severity vulnerability in the Bookly Online Scheduling and Appointment Booking System WordPress plugin up to version 28.4. It allows unauthenticated attackers to access sensitive customer information by exploiting an endpoint that improperly validates requests and uses attacker-supplied identifiers to retrieve personal data. This exposure includes customer names, emails, phone numbers, and internal notes when certain placeholders are used in the booking form's Details step.