Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-02
Rox Appointment Booking - Security Vulnerability (CVE-2026-104012)
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()`…
PLUGIN
Rox Appointment Booking
CVE-2026-104012
Risk Score
Threat Entry
Updated 2026-09-17
Rox Appointment Booking - Security Vulnerability (CVE-2026-87907)
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
PLUGIN
Rox Appointment Booking
CVE-2026-87907
Risk Score
Threat Entry
Updated 2026-09-17
Rox Appointment Booking - Security Vulnerability (CVE-2026-87896)
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.
PLUGIN
Rox Appointment Booking
CVE-2026-87896
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87891)
The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.
PLUGIN
Rox Appointment Booking
CVE-2026-87891
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87894)
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
PLUGIN
Rox Appointment Booking
CVE-2026-87894
Risk Score
Threat Entry
Updated 2026-09-14
Rox Appointment Booking - Security Vulnerability (CVE-2026-87892)
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
PLUGIN
Rox Appointment Booking
CVE-2026-87892
Risk Score