Authorization Flaw in Rox Appointment Booking Plugin by WordPress
CVE-2026-87907
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 16 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87907?
The Rox Appointment Booking plugin for WordPress prior to version 1.2.8 contains a significant vulnerability that permits unauthorized users to access confidential internal notes associated with various booking services and categories. The plugin's endpoints for retrieving these records lack necessary authorization checks, enabling unauthenticated attackers to exploit this weakness and gain access to sensitive information.
Affected Version(s)
Rox Appointment Booking 0 < 1.2.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.