CVE-2026-87894

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

EUVD-2026-76803

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87894

The Rox Appointment Booking WordPress plugin (versions 1.0.9-1.2.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to perform authorization checks on the endpoint responsible for returning booking confirmation details. Because bookings are accessed using seque...

CVE-2026-87894 Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

WordPress Rox Appointment Booking plugin 1.0.9-1.2.2 - Unauthenticated Customer PII Disclosure vulnerability

Unauthenticated Customer PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin Rox Appointment Booking Appointment Booking Scheduling Solution versions 1.0.9-1.2.2...

CVE-2026-87892

The Rox Appointment Booking WordPress plugin, in versions before 1.2.0 , contains a vulnerability where it fails to verify the order total or selected payment method against its own server-side pricing during booking creation. This allows unauthenticated attackers to create confirmed bookings at ...

EUVD-2026-76804

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87892 Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

EUVD-2026-76802

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891 Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

CVE-2026-87891

The Rox Appointment Booking WordPress plugin (versions before 1.2.0 ) is vulnerable to an improper access control issue. The plugin fails to perform necessary capability or authorization checks when saving its holiday schedule via the REST API . This allows unauthenticated attackers to overwrite ...

CVE-2026-87891: Improper Access Control

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates...

PT-2026-90586

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking versions prior to 1.2.0 Description The plugin fails to perform capability or authorization checks when saving the holiday schedule. This allows unauthenticated attackers to overwrite dates treated as unavailable by the...

PT-2026-90587

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

CVE-2026-87892: Improper Access Control

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's...

PT-2026-90588

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...

CVE-2026-87894: Authorization Bypass Through User-Controlled Key

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email...