CVE-2026-87894 in Rox Appointment Booking Plugin
Summary
by MITRE • 09/12/2026
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/12/2026
The Rox Appointment Booking WordPress plugin prior to version 1.2.3 contains a critical security flaw characterized as an insecure direct object reference vulnerability. This issue stems from the application's failure to implement proper authorization checks on the endpoint responsible for retrieving booking confirmation details. In secure software design, any request that accesses sensitive user data must verify that the authenticated user initiating the request has explicit permission to view the specific resource being requested. However, in this implementation, the server processes requests based solely on the provided identifier without validating whether the requester is authorized to access that particular record. This architectural oversight allows unauthenticated actors to bypass authentication mechanisms entirely and interact directly with the backend logic governing booking data retrieval.
The technical root cause of this vulnerability lies in the use of sequential numeric identifiers for each booking entry within the database. Because these identifiers are predictable and increment sequentially, attackers can easily perform enumeration attacks by iterating through a range of integer values. By systematically requesting confirmation details using consecutive IDs, an attacker can retrieve information associated with every existing booking in the system. This method requires no prior knowledge of specific user credentials or session tokens, making it particularly dangerous as it lowers the barrier to entry for malicious actors significantly. The lack of randomization or obfuscation in the primary keys further exacerbates this risk by providing a clear and accessible attack surface.
The operational impact of this vulnerability is severe due to the sensitivity of the data exposed during such enumeration attacks. An attacker can harvest personally identifiable information including customer names, email addresses, phone numbers, detailed booking specifics, and payment statuses. This exposure violates fundamental principles of confidentiality and privacy compliance standards such as GDPR or CCPA, potentially leading to significant legal repercussions for site administrators who fail to protect user data. Furthermore, the availability of this structured personal data facilitates downstream attacks such as targeted phishing campaigns, social engineering efforts, and identity theft. The leakage of payment status information may also aid attackers in assessing the financial value of targets or identifying high-value individuals for further exploitation.
To mitigate this vulnerability, immediate remediation is required by upgrading the Rox Appointment Booking plugin to version 1.2.3 or later where these authorization checks have been properly implemented. In addition to updating the software, administrators should ensure that all endpoints handling sensitive data enforce strict access control policies based on user roles and ownership verification. Implementing rate limiting on API endpoints can also help mitigate enumeration attacks by detecting and blocking excessive request patterns typical of automated scanning tools. From a broader security architecture perspective, this incident highlights the importance of adher to industry standards such as CWE-639 which addresses authorization issues related to indirect object references. Organizations should also consider integrating application layer firewalls that monitor for anomalous access patterns indicative of IDOR exploitation attempts aligned with MITRE ATT&CK techniques involving unauthorized data access through API endpoints.