CVE-2026-2520

The Bookly plugin for WordPress is susceptible to unauthorized data modification due to a lack of capability checks in the 'updateAddon' function, affecting all versions up to and including 27.2. This vulnerability allows authenticated attackers with Subscriber-level access or higher to update any plugin with a main file named 'main.php' to its latest version, potentially leading to malicious alterations. WordPress site administrators using this plugin should prioritize applying the necessary updates to mitigate the risk of exploitation.