CVE-2026-87892: Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Rox Appointment Booking pluginto a version that resolves this vulnerability.Fixed in 1.2.0 - Compensating control
Ensure only authenticated users can create bookings until the Rox Appointment Booking plugin is upgraded to 1.2.0 or later.
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can exploit it; no account or prior authentication is required to create manipulated confirmed bookings.
What booking data can an attacker manipulate?
An attacker can submit an arbitrary order total and select payment methods that bypass the payment-method restrictions configured by the site.
Which installations are affected?
Rox Appointment Booking versions before 1.2.0 are affected.