IT SBIT Services
Schneeberger
DEEN
CVE tracker

Rox Appointment Booking: Privilege escalation via mass assignment

CVE-2026-104012High 8.8

← All vulnerabilities

Summary

The Rox Appointment Booking WordPress plugin up to and including 1.3.1 contains a mass assignment flaw in its public booking REST endpoint. An unauthenticated attacker can store an arbitrary WordPress user ID and an email address in a customer record. When an administrator opens and saves that record, the plugin changes the email address of the linked WordPress account, which allows the attacker to take over that account through a password reset. Exploitation requires an administrator to save the poisoned record and the attacker to know a valid administrator user ID.

Affected

  • Rox Appointment Booking (roxnor), WordPress plugin, all versions up to and including 1.3.1

Fixed in

Unknown. Version 1.3.2 is referenced, but the fix has not been confirmed by the vendor or Wordfence.

Workaround

  • No vendor workaround found.
  • Deactivate the booking module if it is not needed.
  • Restrict access to the public booking REST route at the web application firewall, if this does not break the booking form.

Exploitation

  • Exploited in the wild: not found.
  • Public proof of concept: not found.
  • Search coverage was limited, so this does not prove that no exploit exists.

Our recommendation

  • Check the installed plugin version. Treat 1.3.1 and earlier as affected.
  • Update to the newest release after confirming that it fixes this issue.
  • Check WordPress admin accounts and email addresses for unexpected changes, and check the customer table for unexpected WordPress user IDs.
  • Enable two-factor authentication for administrators and reduce the number of admin accounts.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:22.

Original description (NVD)

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed