CVE-2026-87892

The Rox Appointment Booking WordPress plugin (versions before 1.2.0 ) fails to verify the order total or selected payment method against its own server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the sit...