CVE-2026-87891: Rox Appointment Booking Auth Bypass Flaw

CVE-2026-87891 Overview

CVE-2026-87891 affects the Rox Appointment Booking WordPress plugin in versions prior to 1.2.0. The plugin fails to perform capability or authorization checks when saving its holiday schedule. Unauthenticated attackers can overwrite the dates the booking system treats as unavailable. This allows them to block legitimate bookings or open dates the site owner intended to keep closed. The flaw is categorized under [CWE-284] Improper Access Control and is exploitable remotely over the network without user interaction.

Critical Impact

Unauthenticated attackers can manipulate the holiday schedule of the booking system, disrupting appointment availability and business operations.

Affected Products

• Rox Appointment Booking WordPress plugin versions prior to 1.2.0
• WordPress sites using the vulnerable plugin for appointment scheduling
• Any deployment exposing the plugin's holiday schedule save endpoint to the internet

Discovery Timeline

• 2026-09-12 - CVE-2026-87891 published to NVD
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-87891

Vulnerability Analysis

The Rox Appointment Booking plugin exposes a handler that persists the holiday schedule used by the booking calendar. The handler does not verify the caller's WordPress capability, nor does it validate a nonce or authentication state. An unauthenticated remote actor can invoke the endpoint and submit arbitrary date ranges. The plugin accepts and stores the input as the authoritative holiday configuration.

The impact is limited to integrity and availability of booking data. Attackers cannot read confidential information through this flaw. They can, however, disrupt the booking workflow by marking business days as unavailable or opening dates the site owner closed. Repeated abuse can render the appointment system unreliable and damage customer trust.

Root Cause

The root cause is a missing authorization control on the plugin's holiday schedule save action. The code path does not call WordPress capability functions such as current_user_can() and does not perform nonce validation through check_ajax_referer() or equivalent. Without these controls, WordPress treats the request as valid regardless of the caller's identity or origin. Details are documented in the WPScan Vulnerability Report.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the plugin's admin-ajax or REST endpoint responsible for saving the holiday schedule. The request supplies date values that overwrite the stored holiday configuration. Because the endpoint accepts unauthenticated calls, any internet-connected site running a vulnerable version is reachable.

// No verified proof-of-concept code is published for CVE-2026-87891.
// Refer to the WPScan Vulnerability Report for technical details:
// https://wpscan.com/vulnerability/e7f3b29e-2503-41bb-b15c-3c0ef71a3a00/

Detection Methods for CVE-2026-87891

Indicators of Compromise

• Unexpected changes to the plugin's holiday or unavailable-date configuration in the WordPress database
• Customer complaints about missing availability on known business days or unexpected bookings on closed dates
• HTTP POST requests to admin-ajax.php or plugin REST routes from unauthenticated sources referencing holiday save actions

Detection Strategies

• Review web server access logs for POST requests targeting the plugin's holiday schedule endpoint without an authenticated session cookie
• Enable WordPress audit logging to capture option and post meta modifications tied to the plugin
• Compare the current holiday schedule against a known-good baseline on a scheduled basis

Monitoring Recommendations

• Alert on anonymous requests to admin-ajax.php actions associated with the Rox Appointment Booking plugin
• Monitor for spikes in 200-status responses to plugin endpoints originating from unfamiliar IP ranges
• Track modifications to booking-related database options and correlate with authenticated administrator activity

How to Mitigate CVE-2026-87891

Immediate Actions Required

• Update the Rox Appointment Booking plugin to version 1.2.0 or later on all WordPress sites
• Audit the current holiday schedule against the intended configuration and restore accurate values
• Restrict access to wp-admin and admin-ajax.php at the network or web application firewall layer where feasible

Patch Information

The vendor addressed the issue in Rox Appointment Booking version 1.2.0 by adding authorization checks to the holiday schedule save handler. Site operators should apply the update through the WordPress plugin dashboard or by deploying the packaged release. Confirm the installed version after the update to ensure the patched build is active.

Workarounds

• Deactivate the Rox Appointment Booking plugin until the patched version can be installed
• Deploy web application firewall rules that block unauthenticated POST requests to the plugin's holiday save action
• Limit administrative endpoints to trusted IP addresses through server or firewall configuration

# Example: block unauthenticated requests to the plugin action via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "rox_.*holiday") {
        return 403;
    }
}