Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T06:16:28.110Z",
  "pubdate": "2026-09-12T06:16:28.110Z",
  "executiveSummary": "The Rox Appointment Booking WordPress plugin, in versions prior to 1.2.0, suffers from an Insecure Direct Object Reference (IDOR) and improper input validation vulnerability within its booking creation process.\nThis vulnerability allows unauthenticated attackers to manipulate transaction parameters, specifically the order total and payment method, before the booking is committed to the database.\nThe primary risk implication is financial fraud, as attackers can bypass established pricing structures and payment gateway requirements to secure appointments at arbitrary costs or via unauthorized methods.\nThe vulnerability stems from a lack of server-side verification of client-supplied pricing data. Because the plugin relies on the integrity of user-provided input without cross-referencing these values against the backend server-side pricing configuration, the application is susceptible to remote manipulation.\nExploitation is trivial and requires no authentication, allowing any remote attacker to submit maliciously crafted booking requests that result in confirmed appointments with manipulated financial metadata.\nOrganizations using this plugin are exposed to potential revenue loss and system abuse until the update is applied.",
  "technicalDetails": "The vulnerability resides in the server-side logic responsible for handling booking requests within the Rox Appointment Booking plugin. Specifically, the processing functions for booking submissions fail to enforce server-side validation of the order total and payment method parameters passed from the client-side request.\nWhen a user initiates a booking, the plugin accepts parameters via an HTTP request—likely a POST request to an AJAX endpoint—that define the cost of the service and the selected payment gateway. The root cause is a trust-by-default architecture where the server assumes that the incoming parameters represent the actual, unaltered pricing and payment terms configured in the WordPress backend.\nAn attacker can exploit this by intercepting the booking submission request using a proxy tool (e.g., Burp Suite) and modifying the numerical value representing the 'order_total'. Because the backend does not recalculate or verify this total against the known service cost stored in the plugin's internal database settings, it commits the booking with the user-supplied, manipulated total.\nFurthermore, the attacker can manipulate the 'payment_method' parameter. By supplying values that should be restricted or disabled by the site administrator, an attacker can force the plugin to bypass its own payment gateway configuration logic. This could potentially allow an attacker to bypass payment gateways entirely or force the system into a state where the booking is marked as 'confirmed' without actual payment verification.\nThe attack flow follows these steps: 1) The attacker initiates a standard booking process as a legitimate user would; 2) The attacker captures the submission request before it reaches the server; 3) The attacker modifies the 'price' and 'payment_method' fields within the request body; 4) The server receives the request and processes the booking based on the provided inputs without validation; 5) The database is updated with the fraudulent pricing/payment status, confirming the appointment to the user.\nThis lack of server-side validation creates a significant post-exploitation impact. Not only does it enable unauthorized financial transactions, but it also allows an attacker to manipulate the appointment system's booking status, potentially causing resource exhaustion or administrative confusion within the WordPress installation. Because the vulnerability is accessible to unauthenticated remote attackers, it presents a critical risk to the availability and integrity of the site's reservation system."
}