Medium severity5.3NVD Advisory· Published Sep 25, 2026· Updated Sep 25, 2026
CVE-2026-86837
CVE-2026-86837
Description
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
2- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026
- WordPress Plugins: 25 Vulnerabilities Disclosed, Including RCE and Stored XSSVypr Intelligence · Sep 26, 2026