Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-103365 · Microsoft / collected KEV context

cve-program · CVE-2026-103365

• https://www.wordfence.com/threat-intel/vulnerabilities/id/df578e6c-cecd-4c80-b11c-3916ec22c7c7?source=cve
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/frontend/components/booking/InfoText.php#L389
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/frontend/modules/booking/Ajax.php#L570
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/lib/UserBookingData.php#L838
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/frontend/modules/booking/Ajax.php#L791
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/frontend/modules/booking/Ajax.php#L1515
• https://plugins.trac.wordpress.org/browser/bookly-responsive-appointment-booking-tool/tags/28.3/frontend/modules/booking/Ajax.php#L15
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3730881%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.5&old=3722721%40bookly-responsive-appointment-booking-tool%2Ftags%2F28.4

No related operational record is retained in the current change model.