CVE-2026-87892

MediumCVSS 5.3/10Last modified Sep 14, 2026

Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Sep 12, 2026
Last modified: Sep 14, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-878945.3The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's CVE-2026-878965.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking age CVE-2026-878989.4OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-878999.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87906.1The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox wi CVE-2026-879009.4Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a CVE-2026-879018.3Improper sanitization in the registration module allows reflected Cross-Site Scripting.CVE-2026-879028.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the CVE-2026-879075.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking ser CVE-2026-879087.5multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the pa CVE-2026-879097.5The WP Photo Album Plus plugin for WordPress is vulnerable to Remote Code Execution in all versions via the wppa_image_magick function. This CVE-2026-87916.4The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versi