Unauthenticated booking disclosure and deletion via order ID

Authorization bypass in Ladela Interactive Bookly 28.2 and earlier allows remote attackers to expose booking data and delete non-completed bookings. The bookly_get_form_id handler stores an attacker-controlled order_id, and bookly_render_complete trusts it without verifying that the session created the order. No authentication is required; sequential identifiers expose order tokens and calendar details, while rollback requests cascade-delete associated booking records.