CVE-2026-87892 in Rox Appointment Booking Plugin
Summary
by MITRE • 09/12/2026
The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The Rox Appointment Booking plugin for WordPress versions prior to 1.2.0 contains a critical business logic vulnerability that stems from insufficient server-side validation of transactional data during the booking creation process. This flaw allows unauthenticated attackers to manipulate the price and payment method parameters sent by the client application, effectively bypassing the intended security controls implemented by the plugin developers. The core issue lies in the lack of reconciliation between the values submitted by the user interface and the authoritative pricing rules or configuration settings stored on the server side. In a secure implementation, any financial transaction must be validated against a trusted source of truth to ensure integrity, but this vulnerability leaves that trust assumption unverified, creating an opening for exploitation without requiring valid credentials or authentication tokens.
From a technical perspective, the vulnerability manifests as a form of client-side trust abuse where the application accepts arbitrary values for order totals and payment methods directly from HTTP requests associated with booking creation endpoints. When a user initiates a booking, the frontend typically calculates costs based on local logic or static data provided by the server during page load. However, instead of recalculating these figures using internal business rules upon receiving the POST request to finalize the appointment, the Rox plugin accepts the submitted values at face value. This allows an attacker to craft malicious requests that specify a significantly lower price than what is actually required for the service or select payment methods that are disabled in the site configuration. The server processes this manipulated data and confirms the booking as if it were legitimate, leading to immediate financial loss for the business owner who receives appointments without corresponding revenue.
The operational impact of this vulnerability extends beyond simple monetary theft through underpricing. By bypassing configured payment method restrictions, attackers can force bookings using methods that may not be properly integrated or monitored by the merchant, potentially complicating reconciliation and accounting processes further. For example, if a site disables credit card processing due to high fraud rates but leaves other options open, an attacker could exploit this flaw to submit transactions through channels that are less secure or harder to track. This undermines the security posture of the entire e-commerce workflow associated with appointment scheduling. The ability to create confirmed bookings at arbitrary prices means that businesses relying on this plugin for revenue generation face direct financial exposure and potential reputational damage if customers experience confusion regarding charges or payment failures resulting from manipulated transaction states.
This vulnerability aligns closely with CWE-840, which describes the performance of authorization checks against client-supplied data rather than server-side logic. It also relates to CWE-20, Improper Input Validation, as the application fails to validate that the input parameters for price and payment method are consistent with expected business rules. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior facilitates T1534, Internal Spearphishing, or more accurately in an e-commerce context, it enables direct exploitation of trust relationships similar to principles found in T1078, Valid Accounts, although here the attack is unauthenticated. The lack of server-side verification represents a fundamental failure in maintaining data integrity during state transitions from pending to confirmed booking status.
To mitigate this vulnerability, site administrators must upgrade the Rox Appointment Booking plugin to version 1.2.0 or later where these validation checks have been implemented. Until an update is applied, immediate mitigation strategies should include restricting access to the relevant API endpoints via web application firewall rules that validate input patterns for price and payment method fields against known good values. Additionally, implementing server-side recalculation of all financial totals before confirming any transaction is essential to restore integrity. Security teams should also monitor booking logs for anomalies such as bookings with zero cost or payments through disabled methods, which may indicate active exploitation attempts. Regular auditing of third-party plugin code for similar business logic flaws is recommended to prevent recurrence in other components of the WordPress ecosystem.