CVE-2026-87894 Overview
The Rox Appointment Booking WordPress plugin before version 1.2.3 exposes customer booking data through an unauthenticated Insecure Direct Object Reference (IDOR) [CWE-639]. The plugin's confirmation endpoint returns booking details without performing authorization checks. Each booking uses a sequential numeric identifier, allowing attackers to enumerate identifiers and harvest personal data. Exposed information includes customer names, email addresses, phone numbers, booking details, and payment status.
Critical Impact
Unauthenticated remote attackers can enumerate sequential booking identifiers to extract personally identifiable information (PII) from every customer stored by the plugin.
Affected Products
- Rox Appointment Booking WordPress plugin versions prior to 1.2.3
Discovery Timeline
- 2026-09-12 - CVE-2026-87894 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-87894
Vulnerability Analysis
The vulnerability is a classic Insecure Direct Object Reference flaw affecting the booking confirmation endpoint of the Rox Appointment Booking WordPress plugin. The endpoint accepts a booking identifier as input and returns the complete booking record. It performs no authorization check to verify that the requester owns the booking or holds administrative privileges.
Booking identifiers are assigned sequentially as integers rather than as unguessable random tokens. This design allows an unauthenticated attacker to iterate from identifier 1 upward and retrieve every booking created by the plugin. The exposed data set includes customer name, email address, phone number, appointment details, and payment status.
The issue is remotely exploitable over the network with no authentication or user interaction required. Impact is limited to confidentiality of stored booking data. Integrity and availability of the WordPress site are not affected.
Root Cause
The root cause is a missing authorization check combined with predictable resource identifiers. The confirmation endpoint trusts the client-supplied booking identifier without verifying session ownership or capability. Sequential numeric identifiers eliminate the obscurity that might otherwise slow enumeration.
Attack Vector
An attacker sends HTTP requests to the plugin's confirmation endpoint, incrementing the booking identifier parameter across the expected range. Each response returns a valid booking record for existing identifiers. The attack requires only a web client and network reachability to the target WordPress site. See the WPScan Vulnerability Report for technical details.
Detection Methods for CVE-2026-87894
Indicators of Compromise
- Sequential HTTP GET requests to the plugin's booking confirmation endpoint with incrementing numeric identifier parameters from a single source IP.
- Bursts of successful 200 OK responses returning booking JSON or HTML to unauthenticated sessions.
- Requests from non-browser user agents such as curl, python-requests, or automated scanners hitting booking URLs.
Detection Strategies
- Review WordPress access logs for enumeration patterns against the Rox Appointment Booking confirmation endpoint.
- Deploy a web application firewall (WAF) rule that rate-limits requests to booking endpoints and flags sequential identifier access.
- Correlate anonymous access to booking URLs with subsequent phishing or fraud reports from customers.
Monitoring Recommendations
- Alert on high request volumes to /wp-content/plugins/ paths associated with the Rox Appointment Booking plugin.
- Track unique booking identifier values requested per source IP over rolling time windows.
- Monitor egress data volume from the WordPress host for anomalies that indicate bulk data extraction.
How to Mitigate CVE-2026-87894
Immediate Actions Required
- Upgrade the Rox Appointment Booking plugin to version 1.2.3 or later on all WordPress installations.
- Audit web server access logs for prior enumeration activity against the confirmation endpoint and identify potentially exposed customers.
- Notify affected customers if log analysis indicates their booking data was accessed by unauthorized parties, in line with applicable data protection regulations.
Patch Information
The plugin vendor addressed this issue in version 1.2.3 by adding authorization checks on the booking confirmation endpoint. Refer to the WPScan Vulnerability Report for advisory details and patch references.
Workarounds
- If immediate patching is not possible, disable the Rox Appointment Booking plugin until the update can be applied.
- Restrict access to the plugin's confirmation endpoint at the web server or WAF layer, allowing only authenticated administrative sessions.
- Enforce strict rate limiting on booking-related URLs to slow bulk enumeration attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
