CVE-2026-87892

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

Affected

Rox Appointment Booking

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-09-12

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/971084b9-5bf9-438a-a94d-435d1b1f01d1/

References

• CVE Record
• NVD entry