What is GHSA-88vv-2m3v-gh9q?

GHSA-88vv-2m3v-gh9q is a security advisory published by GitHub Security Advisories with High severity. The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable...

Which CVE IDs does GHSA-88vv-2m3v-gh9q cover?

GHSA-88vv-2m3v-gh9q covers the following CVE IDs: CVE-2026-12626. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-88vv-2m3v-gh9q?

GHSA-88vv-2m3v-gh9q has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

GHSA-88vv-2m3v-gh9qHighCVSS 7.2

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable...

Vendor

GitHub Security Advisories

Published

October 10, 2026

Last Modified

October 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-12626 →

📋 Description

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 28.2 via deserialization of untrusted input via the ‘value’ parameter. This makes it possible for authenticated attackers, with custom-level access and above, to inject a PHP Object. No known gadget chain is available.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-12626
https://plugins.trac.wordpress.org/changeset/3707284/bookly-responsive-appointment-booking-tool
https://www.wordfence.com/threat-intel/vulnerabilities/id/56c5e045-e91c-4517-8164-a21c3e99623b?source=cve
https://github.com/advisories/GHSA-88vv-2m3v-gh9q