CVE-2026-104012 | Roxnor Rox Appointment Booking Plugin up to 1.3.1 on WordPress Mass Assignment booking handleRequest wp_user_id dynamically-determined object attributes

October 31, 2026 Yanac

A vulnerability was found in Roxnor Rox Appointment Booking Plugin up to 1.3.1 on WordPress. It has been classified as critical. This affects the function SaveCustomer::handleRequest of the file /rox-appointment-booking/v1/public/booking of the component Mass Assignment. Performing a manipulation of the argument wp_user_id results in dynamically-determined object attributes.

This vulnerability is known as CVE-2026-104012. Remote exploitation of the attack is possible. No exploit is available.VulDB Recent EntriesRead More