CVE-2026-87891

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking versions prior to 1.2.0

Description The plugin fails to perform capability or authorization checks when saving the holiday schedule. This allows unauthenticated attackers to overwrite dates treated as unavailable by the booking system, potentially blocking legitimate bookings or opening dates intended to remain closed.

Recommendations Update to version 1.2.0 or later.