CVE-2026-87894

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking versions prior to 1.2.3

Description The plugin fails to perform authorization checks on the endpoint that returns booking confirmation details. Because bookings are identified by sequential numeric identifiers, unauthenticated attackers can use Insecure Direct Object Reference (IDOR)—a flaw where an application provides direct access to objects based on user-supplied input—to enumerate these identifiers and access sensitive customer information, including names, emails, phone numbers, booking details, and payment status.

Recommendations Update to version 1.2.3 or later.