Unauthorized Access Vulnerability in Rox Appointment Booking Plugin by WordPress
CVE-2026-87894
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 12 September 2026
Badges
What is CVE-2026-87894?
The Rox Appointment Booking plugin for WordPress prior to version 1.2.3 lacks proper authorization checks on its endpoint that retrieves booking confirmation details. This oversight permits unauthenticated users to enumerate sequential booking identifiers, thereby gaining access to sensitive customer information, including names, email addresses, phone numbers, booking specifics, and payment statuses. This vulnerability poses a significant risk, enabling potential attackers to exploit the system and access confidential booking data without any authentication.
Affected Version(s)
Rox Appointment Booking 1.0.9 < 1.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.