CVE-2026-104012: Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing mass-assignment of the raw request body into a new customer row while CustomerModel::$fillable includes the internal wpuserid column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, SaveCustomer::handleRequest() passes the stored wpuserid and attacker-supplied email to wpupdateuser() — succeeding because LinkedAccount::canChange() unconditionally returns true when the acting user holds the editusers capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).