CVE-2026-87896: Rox Appointment Booking Information Leak

CVE-2026-87896 Overview

CVE-2026-87896 is an information disclosure vulnerability in the Rox Appointment Booking WordPress plugin versions prior to 1.2.8. The plugin exposes a booking agent endpoint that lacks any authorization check. Unauthenticated attackers can query this endpoint over the network and retrieve staff records for every booking agent configured in the plugin. Exposed fields include staff email addresses, phone numbers, private internal notes, and the linked WordPress account name. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest staff personally identifiable information (PII) and WordPress account names, enabling downstream phishing, credential stuffing, and targeted social engineering against site operators.

Affected Products

Rox Appointment Booking WordPress plugin versions before 1.2.8
WordPress sites running the vulnerable plugin with booking agents configured
Any environment where the plugin's staff endpoint is reachable from the internet

Discovery Timeline

2026-09-16 - CVE-2026-87896 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-87896

Vulnerability Analysis

The Rox Appointment Booking plugin exposes a REST endpoint that returns booking agent (staff) records. The endpoint is intended to support the plugin's booking workflow, where site visitors select an available agent for an appointment. However, the response payload includes fields that are not required by unauthenticated visitors, such as email, phone, private internal notes, and the linked WordPress user_login for each agent.

Because the endpoint performs no capability or authentication check, any anonymous client can request the full staff dataset by issuing a single HTTP GET request. The vulnerability requires no user interaction and no privileges. Impact is confined to confidentiality; integrity and availability are not directly affected.

Root Cause

The root cause is a missing authorization check on the staff-listing endpoint. The plugin registers a public route to power the front-end booking widget but returns the raw internal staff record rather than a minimized public projection. There is no filter that strips sensitive fields before serialization, and no permission_callback that restricts access to authenticated administrative contexts.

Attack Vector

An attacker sends an unauthenticated HTTP request to the vulnerable plugin's staff endpoint on any WordPress site running a version before 1.2.8. The server responds with a JSON payload containing every booking agent's email address, phone number, internal notes, and WordPress login name. Attackers can automate enumeration across many sites using the plugin's fingerprint (assets, script handles, or REST namespace) to build target lists for phishing and credential-based attacks.

See the WPScan Vulnerability Report for endpoint specifics and proof-of-concept details.

Detection Methods for CVE-2026-87896

Indicators of Compromise

Unauthenticated HTTP GET requests to the Rox Appointment Booking plugin's staff or agent REST endpoint from unfamiliar IP addresses or automated user agents.
Web server access logs showing repeated 200-status responses for the plugin's staff endpoint without a preceding authenticated session.
Subsequent spear-phishing emails to staff addresses that were previously not published on the site's public pages.

Detection Strategies

Inspect web server and WordPress access logs for requests to the plugin's REST route and correlate response sizes indicating full staff record disclosure.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated access to the vulnerable endpoint until the plugin is upgraded.
Fingerprint installed plugin versions across managed WordPress fleets and alert on any instance running a version below 1.2.8.

Monitoring Recommendations

Forward WordPress access logs and WAF telemetry into a centralized analytics platform for anomaly detection on plugin endpoints.
Monitor outbound email patterns and inbound phishing reports for staff whose contact details may have been exposed.
Track user-agent strings and source ASNs hitting the plugin endpoint to identify scanning campaigns targeting this CVE.

How to Mitigate CVE-2026-87896

Immediate Actions Required

Upgrade the Rox Appointment Booking WordPress plugin to version 1.2.8 or later on all affected sites.
Rotate any credentials or internal notes that referenced sensitive information within the plugin's staff records.
Notify affected staff that their email addresses and phone numbers may have been harvested and advise heightened phishing awareness.

Patch Information

The vendor addressed the missing authorization check in version 1.2.8 of the Rox Appointment Booking plugin. Administrators should apply the update through the WordPress plugin manager or WP-CLI. Refer to the WPScan Vulnerability Report for the fixed-version reference.

Workarounds

Deactivate the Rox Appointment Booking plugin until the patched version can be deployed.
Add a WAF rule or web server access control that blocks unauthenticated requests to the plugin's staff endpoint.
Remove sensitive content from internal notes fields and avoid storing non-public phone numbers or personal identifiers in agent records.

bash

# Update the plugin via WP-CLI
wp plugin update rox-appointment-booking --version=1.2.8

# Verify installed version
wp plugin get rox-appointment-booking --field=version

# Temporary mitigation: deactivate until patched
wp plugin deactivate rox-appointment-booking