CVE-2026-87896: Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

Q: Who can exploit this issue?

Any unauthenticated remote attacker can query the affected agent REST endpoint. No WordPress account or staff-level access is required.

Q: What information can be exposed?

The endpoint can disclose every booking agent's email address, phone number, private internal notes, and linked WordPress account name.

Q: Which installations are affected?

Rox Appointment Booking versions before 1.2.8 are affected. The issue is present because the agent-record endpoint lacks an authorization check.

Published Sep 16, 2026

Updated

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.

Event History

Sep 16, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker can query the affected agent REST endpoint. No WordPress account or staff-level access is required.

What information can be exposed?

The endpoint can disclose every booking agent's email address, phone number, private internal notes, and linked WordPress account name.

Which installations are affected?

Rox Appointment Booking versions before 1.2.8 are affected. The issue is present because the agent-record endpoint lacks an authorization check.