CVE-2026-87907
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
Risk Assessment
An unauthenticated attacker can access confidential internal notes, potentially exposing business information and breaching privacy.
Recommendation
Update the Rox Appointment Booking plugin to version 1.2.8 or later.
Other vulnerabilities in Rox Appointment Booking WordPress plugin
Original NVD description (English source)
The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS