CVE-2026-87896 — Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route

CVE-2026-87896

Rox Appointment Booking < 1.2.8 - Unauthenticated Staff PII Disclosure via Agent REST Route PUBLISHED

Description (CNA)

The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agent (staff) records, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes and the linked WordPress account name for every agent.

Affected (CNA)

Vendor / product	Versions
Unknown / Rox Appointment Booking	affected 0 before 1.2.8

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/658ae610-945a-41cd-ad55-6841fc402035/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.