Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-12T06:16:28.003Z",
  "pubdate": "2026-09-12T06:16:28.003Z",
  "executiveSummary": "The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.0, contains an authorization bypass vulnerability within its holiday schedule management module.\nThis security flaw is categorized as an improper access control vulnerability, where the application fails to perform necessary capability or authorization checks before processing requests to modify calendar availability.\nThe vulnerability allows unauthenticated remote attackers to interact directly with the plugin's backend functions responsible for saving holiday dates. By sending crafted requests, an attacker can overwrite the site's unavailability schedule.\nThe primary risk implications involve operational disruption and the potential for unauthorized reservation manipulation. An attacker can effectively block legitimate customers from booking appointments or conversely, force the system to accept appointments on dates the site owner intended to keep closed for maintenance or holidays.\nNo specific authentication or privilege requirements are necessary for exploitation, as the vulnerable endpoint lacks any session or capability verification. The exploit is entirely network-accessible to any remote actor capable of reaching the WordPress installation's interface.",
  "technicalDetails": "The root cause of this vulnerability is the absence of security checks, such as 'current_user_can()' or nonce verification, within the AJAX handler or endpoint responsible for updating holiday configurations in the Rox Appointment Booking plugin. In the WordPress architecture, functions that perform administrative actions must explicitly validate the requester's identity and permissions to prevent unauthorized execution.\nThe exploitation process involves an attacker identifying the specific action hook or URL endpoint mapped to the holiday saving functionality. Since the application fails to validate the request origin or user session, it accepts parameters defining the 'holiday' schedule directly from the HTTP request body. An attacker can construct a POST request containing malicious serialized data or form-encoded parameters that dictate new start and end dates for the availability system.\nThe attack flow proceeds as follows: First, the attacker maps the vulnerable endpoint, typically associated with the plugin's administrative settings or AJAX gateway. Second, the attacker crafts a request payload designed to overwrite the 'wp_options' table or the custom database schema utilized by the plugin to store holiday availability. Third, the request is dispatched to the server without any authentication headers. Fourth, the plugin backend processes the request as if it were a legitimate administrative operation, writing the malicious date range into the database.\nThe post-exploitation impact includes a total subversion of the plugin's booking logic. By manipulating the holiday schedule, an attacker can perform a Denial of Service (DoS) against the booking functionality by marking all business days as 'holidays,' effectively preventing any new reservations. Alternatively, by removing legitimate holiday blocks, an attacker may force the system into an inconsistent state where staff are unavailable but the booking engine allows reservations, potentially leading to reputational damage and organizational scheduling conflicts. The lack of input sanitization or authorization checks effectively turns a configuration utility into an open interface for any remote party, circumventing the intended plugin security model."
}