CVE-2026-87892: Rox Appointment Booking Auth Bypass Flaw

CVE-2026-87892 Overview

The Rox Appointment Booking WordPress plugin before version 1.2.0 contains a broken access control flaw [CWE-284] that allows unauthenticated attackers to create confirmed bookings at arbitrary prices. The plugin fails to validate the order total and the selected payment method against its own server-side pricing when a booking is created. Attackers can bypass configured payment-method restrictions and manipulate transaction values without authentication. The issue is reachable over the network with low complexity and no user interaction.

Critical Impact
Unauthenticated attackers can create confirmed bookings at arbitrary prices and bypass payment-method restrictions, causing financial and business logic integrity loss on affected WordPress sites.

Affected Products

Rox Appointment Booking WordPress plugin versions before 1.2.0
WordPress sites using the plugin for paid appointment scheduling
Deployments relying on plugin-configured payment-method restrictions

Discovery Timeline

2026-09-12 - CVE-2026-87892 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-87892

Vulnerability Analysis

The vulnerability is a business logic flaw in the booking creation workflow. The plugin accepts the order total and payment method from the client request and persists them without re-computing or validating those values against server-side pricing configuration. An unauthenticated attacker submits a crafted booking request that specifies an arbitrary total, such as zero or a negligible amount. The plugin confirms the booking using the attacker-supplied values instead of the price associated with the selected service.

The same request flow does not enforce which payment methods the site administrator enabled. An attacker can select a payment method that the site owner disabled or restricted to specific services. The integrity impact is limited to booking data and payment routing rather than the full site, but the flaw undermines revenue collection and payment governance.

Root Cause

The root cause is missing server-side validation classified as improper access control [CWE-284]. The plugin trusts client-supplied fields for both the transaction amount and the payment channel. It does not recompute the total from the service catalog, does not compare the submitted amount to authoritative pricing, and does not verify that the selected payment method is permitted for the requested service.

Attack Vector

Exploitation requires only network access to the booking endpoint. No authentication, no elevated privileges, and no user interaction are required. An attacker submits a standard booking request with modified price, total, or payment_method parameters and receives a confirmed booking. See the WPScan Vulnerability Analysis for further technical details.

// No verified proof-of-concept code is published.
// The vulnerability is exercised by tampering with booking
// request parameters that control price and payment method.

Detection Methods for CVE-2026-87892

Indicators of Compromise

Confirmed bookings recorded with totals of 0, negative values, or amounts inconsistent with the configured service price.
Bookings associated with payment methods that are disabled or restricted in the plugin configuration.
Repeated booking submissions from a single IP address targeting the plugin's booking endpoint without prior page navigation.

Detection Strategies

Compare the stored booking total field against the authoritative service price in the plugin database and alert on mismatches.
Review web server access logs for unauthenticated POST requests to the booking creation endpoint containing user-controlled price or payment_method parameters.
Correlate booking creation events with payment gateway callbacks to identify confirmations that lack a matching successful payment.

Monitoring Recommendations

Enable audit logging for all booking creation and modification events, including the submitting IP address and request payload.
Monitor daily booking revenue against expected baselines to catch anomalies indicating price manipulation.
Alert on any booking that uses a payment method not enabled in the current plugin configuration.

How to Mitigate CVE-2026-87892

Immediate Actions Required

Upgrade the Rox Appointment Booking plugin to version 1.2.0 or later on all WordPress sites.
Audit existing bookings created before the upgrade for anomalous totals and unauthorized payment methods, and reconcile with payment gateway records.
Restrict access to the WordPress admin and booking endpoints behind a web application firewall while patching is in progress.

Patch Information

The vendor addressed the issue in Rox Appointment Booking version 1.2.0. Administrators should update through the WordPress plugin manager or replace the plugin files with the fixed release. Refer to the WPScan Vulnerability Analysis for advisory details.

Workarounds

Temporarily disable the Rox Appointment Booking plugin if an immediate upgrade is not possible.
Configure a web application firewall rule to block booking requests where client-supplied price parameters differ from the expected server value.
Require manual confirmation of new bookings and validate payment settlement out-of-band before providing the booked service.

bash

# Update the plugin via WP-CLI to the fixed release
wp plugin update rox-appointment-booking --version=1.2.0

# Verify the installed version
wp plugin get rox-appointment-booking --field=version