CVE-2026-87894

The Rox Appointment Booking WordPress plugin (versions 1.0.9-1.2.2 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The plugin fails to perform authorization checks on the endpoint responsible for returning booking confirmation details. Because bookings are accessed using seque...