CVE-2026-104012

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing...

CVE-2026-104012 Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing...

EUVD-2026-114645

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing...

CVE-2026-104012 Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing...

CVE-2026-104012

The Rox Appointment Booking plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to and including 1.3.1 . The issue stems from the public /rox-appointment-booking/v1/public/booking REST endpoint, which performs mass-assignment of the raw request body i...

CVE-2026-104012: roxnor: The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege…

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing...

PT-2026-134470

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking – Appointment Booking Scheduling Solution versions prior to 1.3.2 Description This issue involves privilege escalation via mass assignment, where the system allows the assignment of multiple properties to an object in a...

WordPress Rox Appointment Booking – Event, Calendar & Appointment Scheduling plugin <= 1.3.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Daryle Minor in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions = 1.3.1...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87896 Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

CVE-2026-87896

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to unauthenticated staff PII disclosure. The root cause is a lack of authorization checks on the endpoint responsible for returning booking agent (staff) records. This allows unauthenticated attackers to acce...

CVE-2026-87907 Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Internal Notes Disclosure vulnerability

Unauthenticated Internal Notes Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...

EUVD-2026-80210

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent staff records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account nam...

CVE-2026-87907

The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.8 , is vulnerable to an unauthenticated internal notes disclosure . The root cause is a lack of authorization checks on the endpoints responsible for returning booking service and category records. This allows unauthenticated ...

EUVD-2026-80211

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category...

WordPress Rox Appointment Booking plugin < 1.2.8 - Unauthenticated Staff PII Disclosure vulnerability

Unauthenticated Staff PII Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.8...