CVE-2026-87892 — Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass

CVE-2026-87892

Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass PUBLISHED

Description (CNA)

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

Affected (CNA)

Vendor / product	Versions
Unknown / Rox Appointment Booking	affected 0 before 1.2.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/971084b9-5bf9-438a-a94d-435d1b1f01d1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.