CVE-2026-2519

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.

• CWE-472

• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/frontend/modules/booking/Ajax.php#L709
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/CartInfo.php#L450
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/UserBookingData.php#L355
• https://plugins.trac.wordpress.org/changeset/3480956/
• https://www.booking-wp-plugin.com/change-log/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ead87d8b-2659-4e8b-a0b9-138b1db89e36?source=cve

Published

Apr 9, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25184Concurrent execution using shared resource with improper syn…7
• CVE-2026-25185Exposure of sensitive information to an unauthorized actor i…5.3
• CVE-2026-25186Exposure of sensitive information to an unauthorized actor i…5.5
• CVE-2026-25187Improper link resolution before file access ('link following…7.8
• CVE-2026-25188Heap-based buffer overflow in Windows Telephony Service allo…8.8
• CVE-2026-25189Use after free in Windows DWM Core Library allows an authori…7.8
• CVE-2026-25190Untrusted search path in Windows GDI allows an unauthorized …7.8
• CVE-2026-25191The installer of FinalCode Client provided by Digital Arts I…8.4
• CVE-2026-25192WebSocket endpoints lack proper authentication mechanisms, e…9.8
• CVE-2026-25193Insertion of Sensitive Information into Log File (CWE-532) i…8.1
• CVE-2026-25194Out-of-bounds write in the firmware for the Intel(R) Slim Bo…1.8
• CVE-2026-25195An OS command injection vulnerability exists in XWEB Pro…6.6