CVE-2026-87891: Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API

Q: Who can exploit this issue?

Any unauthenticated remote attacker who can reach the affected WordPress site's REST API can modify the holiday schedule. No login or WordPress capability is required.

Q: What is the practical impact of a successful exploit?

An attacker can overwrite dates treated as unavailable by the booking system. This can prevent legitimate bookings or make dates available that the site owner intended to keep closed.

Q: Which plugin versions are affected?

ROX Appointment Booking versions before 1.2.0 are affected.

Published Sep 12, 2026

Updated

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.

Affected Software

1 affected component

ROX Appointment Booking<1.2.0

Event History

Sep 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker who can reach the affected WordPress site's REST API can modify the holiday schedule. No login or WordPress capability is required.

What is the practical impact of a successful exploit?

An attacker can overwrite dates treated as unavailable by the booking system. This can prevent legitimate bookings or make dates available that the site owner intended to keep closed.

Which plugin versions are affected?

ROX Appointment Booking versions before 1.2.0 are affected.