WordPress Plugin Vulnerabilities

Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

Description

The plugin does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.

Proof of Concept

Affects Plugins

Plugin icon
rox-appointment-booking
Fixed in 1.2.8

References

CVE
CVE-2026-87907

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://faridnarimanov.com
Submitter twitter
FaridNarimanov
Verified
Yes
WPVDB ID
60f70070-f785-43a2-be51-c01e64fb1821

Timeline

Publicly Published
2026-09-14 (about 2 days ago)
Added
2026-09-14 (about 1 day ago)
Last Updated
2026-09-14 (about 1 day ago)

Other

Published
Title
Published
2025-02-14
Title
Spotlight Social Media Feeds < 1.7.2 - Unauthenticated Sensitive Information Disclosure
Published
2024-12-10
Title
Restrict – membership, site, content and user access restrictions for WordPress < 2.2.9 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2026-08-06
Title
WP < 7.0.3 - Unauthenticated Internal Note Disclosure via Comment Feeds
Published
2025-05-01
Title
Yame | Link In Bio <= 0.9.0 - Unauthenticated Information Exposure
Published
2023-12-07
Title
Backup Migration Staging < 1.3.6 - Sensitive Data Exposure