Description

The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T06:16:28.217Z",
  "pubdate": "2026-09-12T06:16:28.217Z",
  "executiveSummary": "The Rox Appointment Booking plugin, in versions prior to 1.2.3, contains a critical Broken Object Level Authorization (BOLA/IDOR) vulnerability.\nThis flaw allows unauthenticated remote attackers to access sensitive customer booking data, including full names, email addresses, phone numbers, and payment statuses.\nThe vulnerability stems from the absence of proper authorization checks on the confirmation details endpoint combined with the use of predictable, sequential numeric identifiers for booking records.\nThe impact is significant, as it facilitates mass scraping of personally identifiable information (PII) and internal booking operational data without requiring any prior authentication or administrative privileges.\nAttackers can leverage this to conduct unauthorized data harvesting, privacy violations, and potentially facilitate secondary attacks such as targeted phishing or social engineering campaigns based on the exfiltrated user data.\nThe risk is considered high due to the ease of exploitation, requiring only a simple automated script to enumerate identifiers and scrape the database records via the exposed API endpoint.",
  "technicalDetails": "The root cause of this vulnerability is a lack of server-side access control mechanisms within the Rox Appointment Booking plugin's data retrieval workflow. Specifically, the API endpoint responsible for fetching booking confirmation details fails to validate whether the requester possesses the appropriate session permissions or ownership rights to access the requested resource.\nThe application utilizes sequential numeric identifiers to uniquely index bookings within the database. This design pattern, when coupled with the missing authorization logic, creates an Insecure Direct Object Reference (IDOR) condition. Because the identifiers follow a predictable, incremental pattern (e.g., 1001, 1002, 1003...), an attacker can easily iterate through the integer space to identify valid records.\nThe attack flow follows a predictable sequence: First, an unauthenticated attacker identifies the vulnerable endpoint responsible for returning booking confirmations. Second, the attacker crafts a series of HTTP GET requests to this endpoint, systematically incrementing the ID parameter in the request payload. Third, the server, failing to verify if the request originated from the customer associated with that specific ID or an authenticated administrator, processes the request by querying the backend database. Finally, the application returns the sensitive booking record associated with the queried ID to the attacker's client.\nThis exposure permits the unauthorized disclosure of PII including, but not limited to, customer names, contact emails, phone numbers, specific appointment details, and sensitive payment status information. Because the vulnerable component resides in the plugin's frontend or publicly accessible API, it is exposed to the internet and requires no interaction from legitimate administrators or authenticated users. The automated nature of this enumeration allows for rapid mass extraction of the entire booking database, creating a severe post-exploitation impact regarding data privacy compliance and customer trust.\nThis vulnerability persists in all versions of the Rox Appointment Booking plugin prior to 1.2.3. The absence of validation checks means that any entity with network access to the target WordPress instance can execute these queries successfully, bypassing standard security measures typically enforced at the application layer."
}