WordPress Rox Appointment Booking plugin < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability

Unauthenticated Price Manipulation and Payment Method Restriction Bypass vulnerability discovered by Morato Antoine in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.2.0...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin, in versions before 1.2.0 , contains a vulnerability where it fails to verify the order total or selected payment method against its own server-side pricing during booking creation. This allows unauthenticated attackers to create confirmed bookings at ...

CVE-2026-87892: Improper Access Control

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

PT-2026-90587

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-15229 Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price including zero and, by selecting a specific payment method, obtain an instantly-approved reservation...