Is CVE-2026-104012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104012 being exploited in the wild.

How severe is CVE-2026-104012?

High severity, with a CVSS score of 8.8, published 31 October 2026.

Which products and versions are affected?

Rox Appointment Booking – Appointment Booking Scheduling Solution up to and including 1.3.1.

Is there a fix for CVE-2026-104012?

Yes: fixed in 1.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104012 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-104012?

Check whether you run Rox Appointment Booking – Appointment Booking Scheduling Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104012: Rox Appointment Booking privilege escalation via mass assignment

CVE-2026-104012 · Severity: high · CVSS 8.8 · Published 2026-10-31

The Rox Appointment Booking plugin for WordPress allows unauthenticated attackers to create poisoned customer records containing an arbitrary administrator's user ID. When a site administrator opens and saves such a record, their email address is overwritten, enabling the attacker to take over the admin account via password reset. This requires the attacker to know a valid admin user ID and the admin to interact with the malicious record.

Vendors: Rox.

Quick answers

Is CVE-2026-104012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104012 being exploited in the wild.
How severe is CVE-2026-104012?: High severity, with a CVSS score of 8.8, published 31 October 2026.
Which products and versions are affected?: Rox Appointment Booking – Appointment Booking Scheduling Solution up to and including 1.3.1.
Is there a fix for CVE-2026-104012?: Yes: fixed in 1.3.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104012 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-104012?: Check whether you run Rox Appointment Booking – Appointment Booking Scheduling Solution at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.3.2

Technical details

The plugin's public REST endpoint `/rox-appointment-booking/v1/public/booking` performs unsafe mass assignment of request body fields directly into a new customer record, including the internal `wp_user_id` column. The `LinkedAccount::canChange()` method fails to validate authorization when an administrator later edits the poisoned record, allowing arbitrary email updates on the linked WordPress user account via `wp_update_user()`. Exploitation requires knowledge of a target admin user ID and admin interaction with the malicious record.

Affected products

Rox Appointment Booking – Appointment Booking Scheduling Solution up to and including 1.3.1

Timeline

2026-10-31: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.