CVE-2026-2519: Ladela Online Scheduling And Appointment Booking System – Bookly

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and including, 27.0. This is due to the plugin trusting a user-supplied input without server-side validation against the configured price. This makes it possible for unauthenticated attackers to submit a negative number to the 'tips' parameter, causing the total price to be reduced to zero.

Affected products

• Ladela Online Scheduling And Appointment Booking System – Bookly: up to and including 27.0

Published 2026-04-09. Last modified 2026-06-17.