CVE-2026-86837CWE-639

CVE-2026-86837

Medium · published September 25, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
7.4
In the wild
Unconfirmed
What it is

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00182 · 7.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-25T13:17Z
References (1)
https://wpscan.com/vulnerability/5bfed7cf-5bf3-4a3b-a2b6-9f9d48f52fd5/ · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 25 SEP 08:30Z
    Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass
    cvelistv5