CVE-2026-87894

The Rox Appointment Booking WordPress plugin (versions 1.0.9–1.2.2) contains an unauthenticated PII disclosure via an Insecure Direct Object Reference (IDOR). The endpoint returning booking confirmation details performs no authorization check, and each booking is addressed by a sequential numeric...