{"id":"CVE-2026-104012","kind":"vulnerability","aliases":["CVE-2026-104012"],"related":[],"title":"WordPress Rox Appointment Booking plugin lets visitors take over admin accounts","description":"The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).","summary":"The Rox Appointment Booking WordPress plugin, up to and including version 1.3.1, has a public booking endpoint that accepts a user ID field without checks. An unauthenticated attacker can link a booking to an administrator's WordPress account and change that administrator's email, then reset the password to take over the site.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["appointment-booking","package","rox-appointment-booking","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-1.3.1"],"how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or the `rox-appointment-booking` plugin header; versions up to and including `1.3.1` are affected.\n- Look for the public route `/wp-json/rox-appointment-booking/v1/public/booking` on the site.","fix":"- Rox Appointment Booking: unknown (the sources do not name a fixed version).","status":"open","published_at":"2026-10-31T08:16:47+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","triaged_at":"2026-10-31T08:35:00+00:00","updated_at":"2026-10-31T08:35:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-31T08:35:00Z","model":"claude-haiku-5-5","output":{"fix":"- Rox Appointment Booking: unknown (the sources do not name a fixed version).","reach":"internet","title":"WordPress Rox Appointment Booking plugin lets visitors take over admin accounts","impact":"high","summary":"The Rox Appointment Booking WordPress plugin, up to and including version 1.3.1, has a public booking endpoint that accepts a user ID field without checks. An unauthenticated attacker can link a booking to an administrator's WordPress account and change that administrator's email, then reset the password to take over the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","appointment-booking","rox-appointment-booking"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over an administrator account and controls the WordPress site","analyst_note":"Confirm from the plugin vendor or the NVD entry whether a fixed version exists after 1.3.1, since the sources do not state one.","how_to_check":"- Check the installed plugin version in the WordPress admin plugin list or the `rox-appointment-booking` plugin header; versions up to and including `1.3.1` are affected.\n- Look for the public route `/wp-json/rox-appointment-booking/v1/public/booking` on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-1.3.1"],"who_is_affected":"Sites running the Rox Appointment Booking plugin at version 1.3.1 or earlier are exposed, since its public booking endpoint is reachable without login. The risk becomes a full takeover once an administrator opens and saves a poisoned customer record, and an attacker needs a valid administrator user ID, often the default ID 1. Sites without the plugin, or with it removed, are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4451,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104012':14A,17A '-2026':13A,16A '/rox-appointment-booking/v1/public/booking':113C '1':259C '1.3.1':38B,106C 'accept':45B 'account':11A,64B,219C 'act':201C 'address':157C,215C 'admin':10A 'administr':61B,68B,164C,212C,233C,250C 'allow':140C 'alongsid':151C 'appoint':3A,19B,24B,29B,82C,84C 'appointment-book':18B 'arbitrari':147C 'assign':98C,119C 'attack':54B,143C,154C,185C,243C 'attacker-control':153C 'attacker-suppli':184C 'author':160C 'bodi':124C 'book':4A,20B,25B,30B,42B,58B,83C,85C 'canchang':195C 'capabl':207C 'chang':66B 'check':51B,161C 'click':172C 'column':139C 'control':155C 'custom':128C,169C,174C 'customermodel':131C 'cve':12A,15A 'default':256C 'due':109C 'edit':205C 'email':70B,156C,187C,214C 'enabl':217C 'endpoint':43B,115C 'escal':95C 'exploit':230C 'field':49B 'fillabl':132C 'full':218C 'guess':247C 'handlerequest':176C 'hold':203C 'id':48B,138C,150C,182C,252C,258C 'includ':36B,105C,133C 'intern':135C 'know':245C 'let':6A 'link':56B 'linkedaccount':194C 'mass':97C,118C 'mass-assign':117C 'must':244C 'new':127C 'open':166C,235C 'overwrit':209C 'packag':21B 'pass':177C 'password':74B,226C 'password-reset':225C 'perform':116C 'persist':145C 'plugin':5A,32B,88C 'poison':168C,239C 'privileg':94C 'public':41B,112C 'raw':122C 'record':170C,240C 'request':123C,228C 'requir':231C 'reset':72B,227C 'rest':114C 'return':197C 'row':129C 'rox':2A,23B,28B,81C 'rox-appointment-book':22B 'save':237C 'savecustom':175C 'schedul':86C 'site':79B 'solut':87C 'standard':223C 'store':179C 'subsequ':165C 'succeed':192C 'success':229C 'suppli':186C 'take':8A,76B 'takeov':220C 'target':211C 'therebi':208C 'true':198C 'unauthent':53B,142C 'uncondit':196C 'updat':173C,190C 'user':47B,137C,149C,181C,191C,202C,206C,251C,257C 'valid':249C 'version':37B,101C 'via':96C,221C 'visitor':7A 'vulner':92C 'without':50B 'wordpress':1A,26B,31B,63B,90C,148C,224C 'wp':136C,180C,189C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Rox Appointment Booking plugin at version 1.3.1 or earlier are exposed, since its public booking endpoint is reachable without login. The risk becomes a full takeover once an administrator opens and saves a poisoned customer record, and an attacker needs a valid administrator user ID, often the default ID 1. Sites without the plugin, or with it removed, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T08:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104012","severity":null,"published_at":"2026-10-31T08:16:47+00:00","modified_at":"2026-10-31T08:16:47+00:00","first_seen_at":"2026-10-31T08:34:28+00:00","fetched_at":"2026-10-31T08:34:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}