Threats tagged 'ghsa-688p-jfpg-cv62'

The Bookly plugin for WordPress up to version 28.4 contains an authorization bypass vulnerability due to insecure direct object reference via user-controlled parameters. Authenticated users with subscriber-level access or higher can exploit this flaw to overwrite the WordPress account binding of any Bookly staff record, including administrators, leading to privilege escalation. Exploitation requires the attacker to be linked to at least one Bookly staff record, which is enabled by default on fresh installs with a specific option active.