Privilege Escalation Vulnerability in Rox Appointment Booking Plugin for WordPress

CVE-2026-104012

What is CVE-2026-104012?

The Rox Appointment Booking plugin for WordPress contains a vulnerability that allows an unauthenticated attacker to exploit the mass assignment functionality in the public REST endpoint. This flaw enables the attacker to associate an arbitrary WordPress user ID with any email address when a new customer record is created. The issue arises because the 'wp_user_id' field is improperly included in the fillable attributes of the CustomerModel class. If an administrator later accesses the compromised record and updates it, the stored user ID and email can be erroneously validated, leading to an unauthorized modification of the administrator's email address. This paves the way for complete account takeover once the attacker executes a password reset on the modified account.

References