CVE-2026-104012
Received Received - Intake

Privilege Escalation via Mass Assignment in Rox Appointment Booking WordPress Plugin

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-104012
EUVD
EUVD-2026-114645

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
roxnor Rox Appointment Booking – Event, Calendar & Appointment Scheduling 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a privilege escalation flaw in the Rox Appointment Booking WordPress plugin. It allows unauthenticated attackers to link an arbitrary WordPress user ID to an attacker-controlled email address via a public REST endpoint. When an admin opens and saves the poisoned customer record, the attacker can overwrite the admin's email address, enabling full account takeover through a password reset.

Detection Guidance

This vulnerability can be detected by checking for unauthorized user ID modifications in WordPress. Look for unexpected changes in the wp_users table, particularly in the user_email field for administrators. Review REST API logs for POST requests to /rox-appointment-booking/v1/public/booking with raw request bodies containing wp_user_id fields.

Impact Analysis

If you use the vulnerable plugin, an attacker could gain full control of your WordPress admin account. This could lead to website defacement, data theft, malware distribution, or complete site compromise. The attack requires an admin to open the poisoned record but does not require authentication.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. A successful exploit may result in unauthorized modifications or exfiltration of personal data, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Immediately update the Rox Appointment Booking plugin to version 1.3.2 or later. Disable the plugin temporarily if an update is unavailable. Review all administrator accounts for unauthorized email changes and reset passwords for any affected accounts. Monitor for suspicious activity in WordPress logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104012. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart