CVE-2026-87907: Rox Appointment Booking Information Disclosure

CVE-2026-87907 Overview

CVE-2026-87907 is an information disclosure vulnerability in the Rox Appointment Booking WordPress plugin versions before 1.2.8. The plugin fails to enforce authorization checks on endpoints that return booking service and category records. Unauthenticated attackers can query these endpoints and retrieve private internal notes stored on each service and category. The flaw is classified under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Remote, unauthenticated attackers can read private internal notes attached to booking services and categories, exposing potentially sensitive business or customer information.

Affected Products

Rox Appointment Booking WordPress plugin versions prior to 1.2.8
WordPress sites with the vulnerable plugin installed and activated
Any deployment exposing the plugin's service/category REST endpoints to the internet

Discovery Timeline

2026-09-16 - CVE-2026-87907 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-87907

Vulnerability Analysis

The Rox Appointment Booking plugin exposes REST endpoints that return booking service and category records to any HTTP client. The endpoints omit capability and authentication checks, so requests from unauthenticated clients receive the same payloads as authorized administrators. Those payloads include private internal notes intended only for site staff.

The returned notes may contain scheduling context, customer remarks, pricing rationale, or operational details that were never meant to be public. Attackers can enumerate all services and categories in a single scan, aggregating disclosed data across many sites running the plugin.

Root Cause

The root cause is a missing authorization check on the plugin's service and category retrieval endpoints. The handlers return full record objects, including the internal notes fields, without validating the requester's identity or role. This is a broken access control condition mapped to [CWE-200].

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker sends an HTTP request to the vulnerable endpoint and parses the JSON response to extract the internal notes. No credentials, user interaction, or elevated privileges are needed. See the WPScan Vulnerability Report for endpoint specifics.

No verified proof-of-concept code is published in the referenced sources, so exploitation is described in prose only.

Detection Methods for CVE-2026-87907

Indicators of Compromise

Unauthenticated HTTP GET requests to the Rox Appointment Booking plugin's service or category REST endpoints from unfamiliar IP addresses.
Bursts of sequential requests enumerating service or category identifiers within short time windows.
Web server access logs showing large response bodies returned to unauthenticated clients from plugin endpoints.

Detection Strategies

Inventory WordPress installations and identify sites running Rox Appointment Booking below version 1.2.8.
Review REST API access logs for anonymous requests targeting the plugin's service and category routes.
Alert on repeated 200 responses to unauthenticated requests against booking endpoints, especially from non-browser user agents.

Monitoring Recommendations

Forward WordPress and reverse-proxy access logs to a centralized analytics platform for correlation and retention.
Baseline normal API request patterns for the plugin and flag deviations in request volume or source diversity.
Track outbound data volumes from plugin endpoints to detect bulk enumeration attempts.

How to Mitigate CVE-2026-87907

Immediate Actions Required

Update the Rox Appointment Booking plugin to version 1.2.8 or later on all affected WordPress sites.
Audit existing service and category records and rotate or redact any sensitive data previously stored in internal notes.
Review web server logs for prior unauthenticated access to the vulnerable endpoints and assess data exposure.

Patch Information

Upgrade the Rox Appointment Booking plugin to version 1.2.8 or later. This release adds the missing authorization checks on the service and category endpoints. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Deactivate and remove the plugin until it can be updated to a patched version.
Restrict access to the plugin's REST endpoints at the web application firewall (WAF) or reverse proxy layer.
Remove sensitive content from internal notes fields until the patch is applied.

bash

# Example WAF rule concept: block unauthenticated access to plugin endpoints
# Replace <plugin-route> with the specific REST route once identified from the advisory
location ~ ^/wp-json/<plugin-route>/(services|categories) {
    if ($http_authorization = "") { return 401; }
}