PT-2026-93312

CVE-2026-87907

Published

2026-09-16

Updated

2026-09-24

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rox Appointment Booking WordPress plugin versions prior to 1.2.8

Description The plugin fails to perform authorization checks on endpoints that return booking service and category records. This allows unauthenticated attackers to access and read private internal notes associated with each service and category.

Recommendations Update the plugin to version 1.2.8 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Farid Narimanov

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers