WordPress Plugin Vulnerabilities

Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR

Description

The plugin does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.

Proof of Concept

Affects Plugins

Plugin icon
rox-appointment-booking
Fixed in 1.2.3

References

CVE
CVE-2026-87894

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://faridnarimanov.com
Submitter twitter
FaridNarimanov
Verified
Yes
WPVDB ID
3f098db1-5406-4a77-adb1-99a66eb806a4

Timeline

Publicly Published
2026-09-10 (about 2 days ago)
Added
2026-09-10 (about 1 day ago)
Last Updated
2026-09-10 (about 1 day ago)

Other

Published
Title
Published
2026-06-05
Title
MapPress Maps for WordPress < 2.97.1 - Unauthenticated Insecure Direct Object Reference via REST API Endpoints
Published
2026-02-11
Title
Paid Member Subscriptions < 2.16.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-26
Title
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution < 5.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Information Disclosure via 'id' Parameter
Published
2025-03-13
Title
WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
Published
2026-07-07
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.3.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite