CVE-2026-87907
Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
| Vendor | unknown |
| Product | rox appointment booking |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown rox appointment booking
Be the first to know when new unknown vulnerabilities affecting unknown rox appointment booking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Rox Appointment Booking
0 < 1.2.8
References
Credits
Farid Narimanov WPScan