CVE-2026-87894
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
| Vendor | unknown |
| Product | rox appointment booking |
| Published | Sep 12, 2026 |
| Last Updated | Sep 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown rox appointment booking
Be the first to know when new medium vulnerabilities affecting unknown rox appointment booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Rox Appointment Booking
1.0.9 < 1.2.3
References
Credits
Farid Narimanov WPScan