CVE-2026-87894
Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR
cve-program · severity unknownCVSS unknownCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-87894
PublishedThe Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-87894 · CVE overview and exploitation status
cve-program · CVE-2026-87894
Related changes
Linked by CVE identifierNo related changes are available here.