CVE-2026-87894: Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites using Rox Appointment Booking versions before 1.2.3 are affected. The issue is reachable without authentication.
What does an attacker need to exploit this issue?
An attacker only needs to enumerate the sequential numeric booking identifier used by the confirmation-details endpoint. No login or authorization is required.
What information can be disclosed?
An attacker can retrieve customer names, email addresses, phone numbers, booking details, and payment status for enumerated bookings.
How can I tell whether my site may already be exposed?
Check whether Rox Appointment Booking is installed at a version earlier than 1.2.3. Because booking identifiers are sequential and the affected endpoint lacks authorization checks, any existing booking records may be accessible through identifier enumeration.