Unrated severityNVD Advisory· Published Sep 12, 2026

CVE-2026-87892

Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

WordPress/Rox Appointment Bookingllm-create
Range: <1.2.0

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/971084b9-5bf9-438a-a94d-435d1b1f01d1/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000