Is CVE-2026-87891 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87891 being exploited in the wild.

How severe is CVE-2026-87891?

Medium severity, with a CVSS score of 6.5, published 12 September 2026.

Which products and versions are affected?

Rox Appointment Booking before 1.2.0.

Is there a fix for CVE-2026-87891?

A patch was published on 2026-09-10: Version 1.2.0 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-87891 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-87891?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87891: Rox Appointment Booking REST API authorization bypass

CVE-2026-87891 · Severity: medium · CVSS 6.5 · Published 2026-09-12

The Rox Appointment Booking WordPress plugin allows unauthenticated users to modify the holiday schedule that controls booking availability. An attacker can block all bookings by marking every future date as unavailable, or re-open dates the site owner intended to keep closed, directly impacting revenue and customer experience.

Quick answers

Is CVE-2026-87891 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87891 being exploited in the wild.
How severe is CVE-2026-87891?: Medium severity, with a CVSS score of 6.5, published 12 September 2026.
Which products and versions are affected?: Rox Appointment Booking before 1.2.0.
Is there a fix for CVE-2026-87891?: A patch was published on 2026-09-10: Version 1.2.0 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-87891 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-87891?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an authorization bypass vulnerability in the plugin's REST API endpoint for saving holiday schedules. The vulnerable REST route uses a permission callback that always returns true, requiring no authentication, nonce validation, or capability checks. Attackers can send unauthenticated POST requests to /wp-json/rox-appointment-booking/v1/menueapi/holiday/save with arbitrary holiday data to completely overwrite the stored holiday option. The booking availability logic then enforces the attacker-supplied dates, allowing denial of service (blocking all bookings) or enabling unauthorized access (opening dates marked closed). The vulnerability is fixed in version 1.2.0.

Affected products

Rox Appointment Booking before 1.2.0

Timeline

2026-09-10: disclosed
2026-09-10: patched: Version 1.2.0 fixes the vulnerability

References

https://wpscan.com/vulnerability/e7f3b29e-2503-41bb-b15c-3c0ef71a3a00/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.