CVE-2026-87896

Executive Summary

CVE-2026-87896 is a missing authorization vulnerability in the Rox Appointment Booking WordPress plugin (versions before 1.2.8). The plugin exposes an endpoint that returns booking agent (staff) records without performing any authorization check, allowing unauthenticated attackers to read staff email addresses, phone numbers, private internal notes, and the linked WordPress account name for every agent. Any WordPress site running an affected version of this plugin is exposed to unauthenticated data disclosure with no prerequisites beyond network reachability of the site.

Technical Analysis

The vulnerability class is a missing authorization check (CWE-862) on a publicly reachable endpoint. According to the NVD description, the Rox Appointment Booking plugin "does not perform any authorization check on the endpoint that returns booking agent (staff) records." This means the endpoint that serves staff/agent data is callable by unauthenticated users and returns records that contain sensitive fields: staff email addresses, phone numbers, private internal notes, and the linked WordPress account name for each agent.

The root cause is the absence of an authorization gate (for example, a capability check such as current_user_can() in WordPress, or a nonce/permission callback on a registered REST route) on the agent-listing endpoint. In WordPress plugin architecture, endpoints are commonly registered via the REST API (register_rest_route) or via admin-ajax.php actions. When the permission_callback is missing, set to __return_true, or the AJAX handler omits a capability/nonce check, the endpoint becomes reachable by anonymous visitors. Because the endpoint returns agent records directly, the confidentiality of agent-related data is lost.

The attack surface is the public HTTP(S) interface of any WordPress site with the affected plugin active. Exploitation requires no authentication, no user interaction, and no special network position — only the ability to send HTTP requests to the site. The NVD description does not disclose the exact endpoint path, parameter names, or the implementation function names, so those details cannot be asserted here. The disclosed impact is strictly information disclosure (C:H/I:N/A:N, as reasoned below); there is no evidence in the provided data of write access, code execution, or privilege escalation.

Given that the affected data includes WordPress account names linked to agents, the leak has secondary value: account names are usable for username enumeration, credential-stuffing targeting, and social engineering. Private internal notes may expose operational details about staff, scheduling, or customers.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available for CVE-2026-87896 per the provided intelligence. The attack chain below is inferred from the vulnerability class (missing authorization / unauthenticated information disclosure) and the NVD description only. No specific function names, endpoint paths, or parameter names are asserted because none are provided.

1. Reconnaissance / target identification: An attacker identifies WordPress sites running the Rox Appointment Booking plugin. Passive fingerprinting can be performed via public HTTP response characteristics (e.g., plugin assets referenced in page HTML) or via internet-wide scan services using the Shodan dorks listed in the METADATA section. Version identification may be possible through residual plugin metadata or readme exposure; the attacker seeks any version below 1.2.8.

2. Triggering the flaw class: The attacker sends an unauthenticated HTTP request directly to the plugin endpoint that returns booking agent (staff) records. Because the endpoint performs no authorization check, the request is processed as an anonymous user and returns the agent dataset. No login, session cookie, or nonce is required. The exact HTTP method, route, and parameters are not disclosed in the provided data and are therefore not specified here.

3. Payload / execution method at the vulnerability-class level: This is a direct-object/endpoint access attack — no injection payload is needed. The "payload" is simply the crafted request to the unprotected endpoint. The server-side handler reads the agent records and serializes them into the HTTP response (e.g., JSON or HTML output), which the attacker captures.

4. Post-exploitation impact: The attacker obtains, for every agent: email addresses, phone numbers, private internal notes, and linked WordPress account names. These can be used for phishing and social engineering against staff, username enumeration for credential-stuffing against WordPress authentication, and reconnaissance of internal business operations via the notes. No lateral movement, remote code execution, or data modification is described for this CVE; the confirmed impact is disclosure of the agent dataset.

Impact Assessment

The NVD description confirms an unauthenticated information disclosure affecting staff/agent records. The affected systems are WordPress installations hosting the Rox Appointment Booking plugin at a version below 1.2.8. Blast radius is bounded by the number of agents configured in each site; the endpoint returns records for every agent, so all staff data in scope on a vulnerable instance is exposed in a single request.

Impact mapping (per NVD description; no CVSS score or vector was provided by the source data — the vector in METADATA is an analytical estimate for missing authorization with high confidentiality impact and no integrity/availability impact):

• Confidentiality: High. Exposed fields include email addresses, phone numbers, private internal notes, and linked WordPress account names.
• Integrity: None described — no write capability is stated.
• Availability: None described.
• Privileges required: None — the endpoint is reachable unauthenticated.
• User interaction: None.

Business impact includes privacy exposure of staff PII (email and phone), disclosure of private operational notes, and increased exposure to phishing, social engineering, and credential-stuffing campaigns that leverage leaked account names and email addresses. Because the data is business/employee information, organizations may also face notification and compliance obligations depending on jurisdiction.

EPSS is 0.00177 (7.5th percentile), indicating low predicted exploitation activity at the time of reporting; the CVE is not in CISA KEV, and no public exploit or PoC is known. This lowers immediate urgency but does not change the fact that exploitation is trivial for a motivated attacker once the plugin and version are identified.

Detection Guidance

Sigma Rule

title: Unauthenticated Access to Rox Appointment Booking Agent Records (CVE-2026-87896)
id: 6f1c9d3a-2b7e-4c8a-9f10-3d5a7e2b1c44
status: experimental
description: Detects unauthenticated requests to the Rox Appointment Booking plugin endpoint that returns agent (staff) records without authorization checks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87896
author: valtersit.com Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-87896
logsource:
  category: webserver
  product: apache
detection:
  selection_endpoint:
    cs-uri-query|contains:
      - 'rox'
      - 'appointment'
      - 'agent'
  selection_unauth:
    sc-status: 200
    cs-method:
      - 'GET'
      - 'POST'
  filter_authenticated:
    cs-username|exists: true
  condition: selection_endpoint and selection_unauth and not filter_authenticated
falsepositives:
  - Legitimate unauthenticated access to public booking pages
  - Plugin update checks
level: medium

YARA Rule

rule CVE_2026_87896_Rox_Appointment_Booking_Missing_Auth
{
    meta:
        description = "Detects Rox Appointment Booking plugin source where an agent-listing endpoint lacks an authorization/permission check (CVE-2026-87896)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87896"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $plugin_slug = "rox-appointment-booking" ascii nocase
        $agent_word  = "agent" ascii nocase
        $staff_word  = "staff" ascii nocase
        $rest_route  = "register_rest_route" ascii
        $perm_cb     = "permission_callback" ascii
        $true_cb     = "__return_true" ascii
        $ajax        = "wp_ajax_nopriv_" ascii

    condition:
        filesize < 5MB and
        $plugin_slug and
        any of ($agent_word, $staff_word) and
        (
            ($rest_route and $perm_cb and $true_cb) or
            ($ajax)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87896 Rox Appointment Booking Unauthenticated Agent Records Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"rox"; nocase; http.uri; content:"agent"; nocase; http.header; content:"Cookie"; negate; threshold:type limit, track by_src, count 10, seconds 60; classtype:attempted-recon; reference:cve,2026-87896; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-87896; sid:202687896; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and http.request.method in ("GET", "POST") and
    stringContains(url.path, "rox") and stringContains(url.path, "agent") and
    not exists(http.request.headers.Cookie) ]
  [ network where network.protocol == "http" and http.response.status_code == 200 and
    stringContains(url.path, "agent") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where (like(uri_lower, "%rox%agent%") OR like(uri_lower, "%appointment%agent%") OR like(uri_lower, "%rox%staff%"))
| where status=200
| stats count values(uri) as uris values(status) as statuses by src_ip, uri_path
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-87896,">
  <rule id="2026878" level="6">
    <if_sid>31100</if_sid>
    <id>^200$</id>
    <url>/rox.*agent|/appointment.*agent|/rox.*staff</url>
    <description>CVE-2026-87896: Possible unauthenticated access to Rox Appointment Booking agent records</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87896,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue affects versions before 1.2.8, implying 1.2.8 fixes it, but no vendor advisory, changelog, commit, or package evidence is available in the provided data. Treat the following as provisional.

1. Immediate mitigations:

• If the plugin is not business-critical, deactivate and remove Rox Appointment Booking until a verified patched version can be deployed.
• Restrict network access to the affected endpoint at the WAF/reverse proxy (deny unauthenticated requests to the plugin's agent-listing path) once the exact route is identified through plugin source review.
• Apply rate limiting and monitoring to the plugin's REST/AJAX routes to detect enumeration.
• Place the WordPress admin/site behind authentication where operationally feasible (e.g., IP allow-listing for staging/internal sites).

2. Patch/upgrade steps:

• Verify the current plugin version on every WordPress instance. If below 1.2.8, upgrade to 1.2.8 or later via the WordPress plugin update mechanism or a trusted distribution source.
• Validate the vendor changelog or diff before and after upgrade to confirm the authorization check was added to the agent-record endpoint.
• Re-test the endpoint unauthenticated after upgrade to confirm it no longer returns staff records.
• Because patch confidence is 0/4, independently confirm the fix; do not assume 1.2.8 is correct solely from the NVD description.

3. Long-term hardening:

• Maintain an inventory of WordPress plugins and versions; monitor for CVEs affecting installed plugins.
• Enforce least privilege in custom plugin development: every REST route must have a strict permission_callback, and every AJAX handler must verify capability and nonce.
• Adopt a web application firewall with virtual patching for known plugin CVEs.
• Monitor staff/agent PII exposure and prepare notification processes if data disclosure is suspected.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87896
• Vendor/product: Roxnor — Rox Appointment Booking WordPress plugin (no vendor advisory URL provided in source data)
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190: Exploit Public-Facing Application — https://attack.mitre.org/techniques/T1190/
• CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-87896 is NOT listed as of this report)

Threat actor/exploit-in-the-wild evidence: None provided. EPSS 0.00177 (7.5th percentile), no public PoC, no Nuclei template, no exploit code, and not in CISA KEV. This is a low-activity, unauthenticated information-disclosure vulnerability at the time of writing.