MEDIUM
CVE-2026-87894
CVSS
5.3
Description
The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.
Weakness (CWE)
CWE-639
Authorization Bypass (IDOR)
EPSS Score
0.19%
Probability of exploitation in next 30 days
9.3th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.