CVE-2026-104012 (GCVE-0-2026-104012)
Vulnerability from cvelistv5
Published
2026-10-31 07:46
Modified
2026-11-02 14:51
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-269 - Improper Privilege Management
Summary
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| roxnor | Rox Appointment Booking – Event, Calendar & Appointment Scheduling |
Version: 0 ≤ 1.3.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-104012",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T14:50:55.700006Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T14:51:04.867Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Rox Appointment Booking \u2013 Event, Calendar \u0026 Appointment Scheduling",
"vendor": "roxnor",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Daryle Minor"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` \u2014 succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability \u2014 thereby overwriting the targeted administrator\u0027s email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1)."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T07:46:47.528Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38"
},
{
"url": "https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61"
},
{
"url": "https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-11T10:02:19.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-30T19:18:58.000Z",
"value": "Disclosed"
}
],
"title": "Rox Appointment Booking \u003c= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via \u0027/public/booking\u0027 Endpoint"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-104012",
"datePublished": "2026-10-31T07:46:47.528Z",
"dateReserved": "2026-10-01T16:42:36.171Z",
"dateUpdated": "2026-11-02T14:51:04.867Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-104012\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-11-02T14:50:55.700006Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-11-02T14:51:00.542Z\"}}], \"cna\": {\"title\": \"Rox Appointment Booking \u003c= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via \u0027/public/booking\u0027 Endpoint\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Daryle Minor\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\"}}], \"affected\": [{\"vendor\": \"roxnor\", \"product\": \"Rox Appointment Booking \\u2013 Event, Calendar \u0026 Appointment Scheduling\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.3.1\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-10-11T10:02:19.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-10-30T19:18:58.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61\"}, {\"url\": \"https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Rox Appointment Booking \\u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` \\u2014 succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability \\u2014 thereby overwriting the targeted administrator\u0027s email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-10-31T07:46:47.528Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-104012\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-11-02T14:51:04.867Z\", \"dateReserved\": \"2026-10-01T16:42:36.171Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-10-31T07:46:47.528Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…