Vendor
The Rox Appointment Booking plugin for WordPress is vulnerable to unauthenticated mass assignment, allowing attackers to overwrite administrator email addresses and facilitate account takeover.