CVE-2026-87891

6.5 Moyenne

Publiée le 12/09/2026 à 08:16 · Modifiée le 14/09/2026 à 23:10 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed.

Traduire en français

Produits concernés

Unknown Rox Appointment Booking

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/e7f3b29e-2503-41bb-b15c-3c0ef71a3a00/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories