CVE-2026-87896

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking WordPress plugin versions prior to 1.2.8

Description The plugin fails to perform authorization checks on the endpoint used to retrieve booking agent records. This allows unauthenticated attackers to access sensitive staff information, including email addresses, phone numbers, private internal notes, and the linked WordPress account names for all agents.

Recommendations Update the plugin to version 1.2.8 or later.