CVE-2026-87896
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.
Risk Assessment
An unauthenticated attacker can obtain staff contact details and private notes, potentially leading to phishing, spam, and breach of employee privacy.
Recommendation
Update the Rox Appointment Booking plugin to version 1.2.8 or later.
Other vulnerabilities in Rox Appointment Booking WordPress plugin
Original NVD description (English source)
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS