A critical Insecure Direct Object Reference vulnerability in the Bookly WordPress plugin allows unauthenticated attackers to perform unauthorized data retrieval and appointment deletion.

The vulnerability exists in multiple AJAX handlers including 'bookly_get_form_id' and 'bookly_render_complete', which fail to perform server-side authorization checks on user-supplied order IDs. This allows unauthenticated attackers to manipulate booking sessions, disclose private customer order tokens, and delete arbitrary appointments.

Successful exploitation leads to significant privacy breaches, as attackers can exfiltrate sensitive customer appointment data and calendar information. Furthermore, the ability to delete bookings results in service disruption and potential operational loss, justifying the critical CVSS score of 9.1.

Immediate Action: Since a specific patched version is not yet confirmed, administrators should deactivate the Bookly plugin immediately if it is not business-critical, or restrict access to the affected booking endpoints via server-side configuration.

Proactive Monitoring: Monitor server access logs for anomalous, sequential requests to the AJAX endpoints mentioned, particularly those originating from unknown or unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to the Bookly AJAX module endpoints, effectively mitigating the risk of IDOR exploitation.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the provided GitHub repository.

Given the critical severity and the existence of public proof-of-concept code, this vulnerability poses a severe risk to data integrity and availability. Security teams must prioritize restricting access to the vulnerable plugin components immediately and should maintain a heightened state of vigilance until an official security update is released and verified by the vendor.