CVE-2026-87907: Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can access the affected WordPress site's REST routes can retrieve service and category records, including their private internal notes. No login or elevated WordPress role is required.
Are sites using the plugin affected by default?
The issue affects Rox Appointment Booking versions earlier than 1.2.8 because the relevant service and category endpoints lack an authorization check. The available information does not identify any configuration setting that disables the exposed routes.
How can I determine whether sensitive information may already be exposed?
Review the internal notes stored on booking service and category records, as those are the data identified as retrievable through the affected endpoints. If those notes contain credentials, personal data, operational details, or other sensitive information, treat them as potentially disclosed.
What should be done if updating is not immediately possible?
The provided information does not specify an official workaround. Until version 1.2.8 or later can be deployed, restrict unauthenticated access to the affected REST routes if your environment can do so without disrupting required booking functionality, and remove sensitive content from service and category internal notes.