Rox Appointment Booking: Privilege Escalation (CVE-2026-104012)

The Rox Appointment Booking plugin for WordPress (versions 1.3.1 and earlier) contains a critical mass assignment vulnerability in the '/rox-appointment-booking/v1/public/booking' REST endpoint. An unauthenticated attacker can inject arbitrary data into the 'wp_user_id' field of a customer record. A subsequent administrative action - viewing and saving the record - triggers an unauthorized email update for the administrator, enabling a password reset attack.

Attack Chain

1. Attacker identifies a WordPress site running the vulnerable Rox Appointment Booking plugin.
2. Attacker sends a crafted HTTP POST request to '/rox-appointment-booking/v1/public/booking'.
3. The plugin executes mass assignment, allowing the attacker to store an arbitrary 'wp_user_id' in a new customer row.
4. An administrator logs into the WordPress dashboard and accesses the appointment management interface.
5. The administrator views the malicious customer record and clicks "Update Customer".
6. The plugin logic 'SaveCustomer::handleRequest()' updates the targeted administrator's email address in the WordPress database.
7. Attacker initiates a standard password reset request for the compromised administrator account.

Impact

Successful exploitation leads to full administrator account takeover. The attacker gains administrative access to the WordPress instance, which can be leveraged for further persistence, data exfiltration, or secondary malware distribution.

Recommendation

• Update the "Rox Appointment Booking - Appointment Booking Scheduling Solution" plugin to the latest version immediately.
• Review administrative user records for unauthorized email address changes.
• Audit the '/rox-appointment-booking/v1/public/booking' endpoint access logs for anomalous POST requests containing unexpected JSON fields.