CVE-2026-87907

Rox Appointment Booking < 1.2.8 - Unauthenticated Internal Notes Disclosure via Service and Category REST Routes

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking service and category records, allowing unauthenticated attackers to read the private internal notes stored on each service and category.

Affected

Rox Appointment Booking

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.34% chance of exploitation in the next 30 days, 26th percentile

Published

2026-09-16

Updated

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/60f70070-f785-43a2-be51-c01e64fb1821/

References

• CVE Record
• NVD entry