Bookly booking plugin:attackers are going after a database flaw on WordPress sites
Published
CVE-2026-61949 lets attackers with no login run database queries on WordPress sites running Bookly 27.7 or earlier. Attacks have been reported. Update to the latest version.
If your website takes appointments with the Bookly plugin, check it is on version 27.8 or later today. CVE-2026-61949 is an SQL injection flaw in Bookly 27.7 and earlier (CVE record) that someone with no account can use, and attackers are trying it (Previdian). The latest version is 28.8 (WordPress.org).
Bookly is on more than 60,000 WordPress sites (WordPress.org), and booking forms often hold customer names, emails and phone numbers.
Who is affected
- Bookly 27.7 and earlier. 27.8 fixes it (CVE record, Patchstack).
- How it works: the plugin builds a database query from text a visitor sends, so an attacker can make the database answer their own questions. Patchstack says this kind of flaw can expose the whole database, including user accounts (Patchstack).
- It is rated 9.3 out of 10 (Patchstack).
What has been seen so far
A snapshot from 12 November:
- Patchstack disclosed the flaw on 16 July with 27.8 as the fix, and the CVE was published on 23 July (Patchstack, CVE record).
- Previdian now lists it as exploited, based on a high-confidence report from a third party it does not name (Previdian). CIRCL's Vulnerability-Lookup logged it as exploited on 11 November.
- We have found no public exploit code and no count of affected sites. It is not in CISA's Known Exploited Vulnerabilities catalog.
What to do
- Update Bookly from Plugins in the WordPress admin, and turn on automatic updates for it.
- Were you on 27.7 or earlier until now? Look for WordPress users you don't recognise, change administrator passwords, and consider whether customer booking data may have been read.
- Site run by a web developer or agency? Ask them which Bookly version you are on today.
How we can help
Worried your booking site has been accessed? Get in touch.