{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/rox-appointment-booking--appointment-booking-scheduling-solution--1.3.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:rox:appointment_booking:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-104012"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Rox Appointment Booking – Appointment Booking Scheduling Solution (\u003c= 1.3.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Rox"],"content_html":"\u003cp\u003eThe Rox Appointment Booking plugin for WordPress (versions 1.3.1 and earlier) contains a critical mass assignment vulnerability in the '/rox-appointment-booking/v1/public/booking' REST endpoint. An unauthenticated attacker can inject arbitrary data into the 'wp_user_id' field of a customer record. A subsequent administrative action - viewing and saving the record - triggers an unauthorized email update for the administrator, enabling a password reset attack.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running the vulnerable Rox Appointment Booking plugin.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted HTTP POST request to '/rox-appointment-booking/v1/public/booking'.\u003c/li\u003e\n\u003cli\u003eThe plugin executes mass assignment, allowing the attacker to store an arbitrary 'wp_user_id' in a new customer row.\u003c/li\u003e\n\u003cli\u003eAn administrator logs into the WordPress dashboard and accesses the appointment management interface.\u003c/li\u003e\n\u003cli\u003eThe administrator views the malicious customer record and clicks \u0026quot;Update Customer\u0026quot;.\u003c/li\u003e\n\u003cli\u003eThe plugin logic 'SaveCustomer::handleRequest()' updates the targeted administrator's email address in the WordPress database.\u003c/li\u003e\n\u003cli\u003eAttacker initiates a standard password reset request for the compromised administrator account.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation leads to full administrator account takeover. The attacker gains administrative access to the WordPress instance, which can be leveraged for further persistence, data exfiltration, or secondary malware distribution.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Rox Appointment Booking - Appointment Booking Scheduling Solution\u0026quot; plugin to the latest version immediately.\u003c/li\u003e\n\u003cli\u003eReview administrative user records for unauthorized email address changes.\u003c/li\u003e\n\u003cli\u003eAudit the '/rox-appointment-booking/v1/public/booking' endpoint access logs for anomalous POST requests containing unexpected JSON fields.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T09:55:10Z","date_published":"2026-10-31T09:55:10Z","id":"https://feed.craftedsignal.io/briefs/2026-10-rox-appointment-booking-privilege-escalation/","summary":"The Rox Appointment Booking plugin for WordPress is vulnerable to unauthenticated mass assignment, allowing attackers to overwrite administrator email addresses and facilitate account takeover.","title":"Rox Appointment Booking: Privilege Escalation (CVE-2026-104012)","url":"https://feed.craftedsignal.io/briefs/2026-10-rox-appointment-booking-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Rox Appointment Booking – Appointment Booking Scheduling Solution (\u003c= 1.3.1)","version":"https://jsonfeed.org/version/1.1"}