443 matches found
CVE-2026-87907
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87896
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87896
The Rox Appointment Booking WordPress plugin versions below 1.2.8 are affected by an unauthenticated PII disclosure vulnerability in its REST endpoint for booking agent (staff) records. The root cause is a missing authorization check on that endpoint, allowing any unauthenticated attacker to read...
CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Internal Notes Disclosure vulnerability
Unauthenticated Internal Notes Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...
EUVD-2026-80210
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Staff PII Disclosure vulnerability
Unauthenticated Staff PII Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...
CVE-2026-87907
The Rox Appointment Booking WordPress plugin (versions
EUVD-2026-80211
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
CVE-2026-87896: Exposure of Sensitive Information to an Unauthorized Actor
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
PT-2026-93312
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
PT-2026-93311
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...
CVE-2026-87907: Exposure of Sensitive Information to an Unauthorized Actor
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...
WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Holiday Schedule Modification vulnerability
Unauthenticated Holiday Schedule Modification vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...
WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability
Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability discovered by Morato Antoine in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...
CVE-2026-87891
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...
CVE-2026-87894
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...