CVE-2026-2520: Ladela Online Scheduling And Appointment Booking System – Bookly

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version.

Affected products

• Ladela Online Scheduling And Appointment Booking System – Bookly: up to and including 27.2

Published 2026-09-08. Last modified 2026-09-08.