The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass…

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing mass-assignment of the raw request body into a new customer row while CustomerModel::$fillable includes the internal wpuserid column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, SaveCustomer::handleRequest() passes the stored wpuserid and attacker-supplied email to wpupdateuser() — succeeding because LinkedAccount::canChange() unconditionally returns true when the acting user holds the editusers capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid…

curl https://cve.zerocrew.in/api/cve/CVE-2026-104012