CVE-2026-2520: 
WordPress vulnerability analysis and mitigation

CVE-2026-2520 is a missing authorization vulnerability in the "Online Scheduling and Appointment Booking System – Bookly" plugin for WordPress, affecting all versions up to and including 27.2. The flaw exists in the updateAddon function, which lacks a proper capability check, allowing authenticated attackers with Subscriber-level access or above to force-update any plugin whose main file is named main.php to its latest version. It was published on September 8, 2026, with a patch available via changeset 3504922. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-862 (Missing Authorization): the updateAddon function in lib/PluginsUpdater.php (lines 10 and 105) does not verify whether the requesting user has sufficient privileges before executing a plugin update action. An authenticated attacker with the lowest default WordPress role (Subscriber) can send a crafted network request to invoke this function, triggering an update of any installed plugin whose entry point is main.php. No complex conditions or user interaction are required beyond holding a valid authenticated session (GitHub Advisory, Wordfence).

Successful exploitation allows an authenticated low-privileged user to remotely trigger plugin updates on the WordPress site, potentially replacing a plugin with a version that introduces breaking changes, regressions, or — if the update source is compromised — malicious code. This results in low integrity and low availability impact: plugin functionality may be disrupted and unauthorized code could be introduced into the WordPress environment. Confidentiality is not directly impacted, but a chained attack leveraging a malicious plugin update could escalate to full site compromise (GitHub Advisory, Wordfence).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The vulnerability requires authentication (Subscriber-level or above), which limits opportunistic mass exploitation. The EPSS score is approximately 0.219% (12th percentile), indicating a low near-term exploitation probability. The CVE status is listed as "Deferred" and it is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Wordfence).

1. Reconnaissance: Identify WordPress sites running the Bookly plugin (version ≤ 27.2) by checking plugin headers, readme files, or using tools like WPScan.
2. Obtain authenticated access: Register or obtain credentials for a Subscriber-level (or higher) WordPress account on the target site — the minimum required privilege level.
3. Identify target plugins: Enumerate installed plugins on the site that use main.php as their primary file, as only these are eligible for the unauthorized update action.
4. Invoke the vulnerable function: Send an authenticated HTTP request (e.g., a POST to the WordPress admin-ajax endpoint or equivalent) calling the updateAddon function in lib/PluginsUpdater.php with the target plugin specified, bypassing the missing capability check.
5. Trigger plugin update: The server processes the request without authorization validation and updates the specified plugin to its latest version, potentially disrupting functionality or (in a supply-chain scenario) introducing malicious code (GitHub Advisory, Wordfence).

• Logs: WordPress access logs showing authenticated POST requests to admin-ajax.php or similar endpoints invoking updateAddon from low-privileged user accounts; unexpected plugin update entries in WordPress debug logs or update history.
• File System: Unexpected changes to plugin files (particularly main.php files of installed plugins) with recent modification timestamps not corresponding to scheduled maintenance windows; new or altered plugin files following an unauthorized update.
• Process/Application: WordPress admin dashboard showing recent plugin updates not initiated by an administrator; plugin version changes logged in the WordPress site health or activity log plugins.

Update the Bookly plugin to a version newer than 27.2, which includes the fix introduced in changeset 3504922 that adds proper capability checks to the updateAddon function. As an interim measure, restrict Subscriber-level user registrations if not required, and audit which users hold elevated roles. Additionally, monitor plugin update activity and verify the integrity of plugin files, especially those with main.php as their main entry point (GitHub Advisory, Wordfence).