EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894

CVE-2026-87894 affects the Rox Appointment Booking WordPress plugin, versions 1.0.9 through 1.2.2 . The vulnerability is an unauthenticated IDOR (Insecure Direct Object Reference) on the endpoint that returns a booking's confirmation details. Because the plugin performs no authorization check and...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin versions before 1.2.0 fail to verify the order total or the selected payment method against server-side pricing when creating a booking. This allows unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass the site's conf...

EUVD-2026-76804

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin, versions before 1.2.0 , lacks a capability or authorization check when saving its holiday schedule via the REST API. This allows unauthenticated attackers to overwrite the dates the booking system treats as unavailable, potentially blocking legitimate...

EUVD-2026-76802

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...