CVE-2026-87894
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier. This allows unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Risk Assessment
An unauthenticated attacker can obtain personal data and booking details of all customers, which is a serious privacy breach and may result in legal consequences (GDPR). The risk to reputation and compliance is high.
Recommendation
Update the plugin to version 1.2.3 or later to fix the missing authorization check.
Other vulnerabilities in Rox Appointment Booking
See all- CVE-2026-104012High
The Rox Appointment Booking plugin for WordPress (up to 1.3.1) is vulnerable to Privilege Escalation via Mass Assignment. The public REST endpoint allows unauthenticated attackers to persist an arbitrary WordPress user ID (wp_user_id) with a controlled email address. When an administrator opens and saves the customer record, the administrator's email is overwritten, enabling account takeover.
- CVE-2026-87892Medium
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
- CVE-2026-87891Medium
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule. This allows unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
Original NVD description (English source)
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS