CVE-2026-87907

Executive Summary

CVE-2026-87907 is a missing-authorization vulnerability in the Rox Appointment Booking WordPress plugin affecting all versions before 1.2.8. The plugin exposes endpoints that return booking service and category records without performing any authorization check, allowing an unauthenticated attacker to retrieve the private internal notes stored on each service and category. Impact is limited to confidentiality (unauthorized disclosure of internal business notes); there is no evidence of integrity or availability impact, no public exploit code, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability class is Missing Authorization (CWE-862), mapped to MITRE ATT&CK T1190 — Exploit Public-Facing Application. The NVD description states that the plugin "does not perform any authorization check on the endpoints that return booking service and category records." This is an access-control failure at the REST/HTTP endpoint layer rather than an injection or memory-safety defect.

Two distinct weaknesses combine here:

1. Missing capability check. The endpoints that serialize booking service and category records are reachable without any authentication or capability validation. In WordPress, a properly hardened plugin registers REST routes with a permission_callback (or performs a current_user_can() check inside the handler). When that check is absent — or returns true unconditionally — any remote client that can reach the route is treated as authorized. The NVD text does not name the specific route, register function, or parameter, so no endpoint path or function name can be asserted here.

2. Over-broad response serialization (data exposure). The affected endpoints return records for services and categories, and those records embed a private internal notes field. Because the response object is not filtered to public-safe fields, the sensitive notes are emitted alongside benign booking metadata. This is the "excessive data exposure" pattern layered onto the authorization gap — even if the list itself were intended to be public, the notes field was not intended for anonymous consumption.

Attack surface. The endpoints are part of a WordPress plugin exposed through the standard web front end of any site running Rox Appointment Booking < 1.2.8. Because the plugin is internet-facing by design (booking functionality is customer-facing), the vulnerable routes are reachable by any anonymous visitor — no account, no session, and no CSRF token is required. Reconnaissance requires nothing more than identifying the plugin and issuing an unauthenticated request.

Why the notes matter. "Private internal notes" on services and categories typically contain operational context not meant for customers: pricing rationale, margin or cost information, staffing constraints, partner/contractor names, internal escalation paths, promotional strategy, or free-text reminders written by site administrators. Disclosure of this material is a business-confidentiality issue rather than a direct technical compromise of the host.

Severity framing. No CVSS score or vector was provided in the intelligence feed (CVSS: N/A). Using the exact supplied value, severity is not scored by the source. The vector below is provided as an analytical placeholder derived strictly from the described properties — network reachable, low complexity, no privileges, no user interaction, confidentiality-only, unchanged scope — and should not be treated as an authoritative vendor or NVD score:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS is 0.00177, placing the flaw at roughly the 7.5th percentile of exploited CVEs — i.e., a low near-term exploitation likelihood at the time of writing. There is no Nuclei template, no public PoC, and no exploit code in the collected data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description only. No endpoint paths, function names, or parameter names are invented, because the source description does not provide them.

1. Reconnaissance / target identification. An attacker enumerates internet-facing WordPress sites and fingerprints those running the Rox Appointment Booking plugin below 1.2.8. Passive fingerprinting can be performed via search engines or Shodan using plugin-path/content markers; active fingerprinting issues a benign request to the site and inspects responses for plugin artifacts. WordPress REST route enumeration (the standard wp-json surface) is a common triage step for mapping any plugin's exposed endpoints, though the specific route belonging to this plugin is not documented in the supplied data.

2. Triggering the flawed request. The attacker sends an unauthenticated HTTP request to the plugin endpoint(s) that "return booking service and category records," as named in the NVD description. Because no authorization check is performed, the request succeeds without credentials, cookies, or capability tokens. No authentication bypass technique, malformed input, or injection payload is required — the vulnerability is triggered by a well-formed, anonymous request to a route that should have enforced access control.

3. Payload / execution method. There is no code-execution payload at the vulnerability-class level. The "payload" is simply the read request itself. Exploitation succeeds because the server-side handler fails to validate the caller's identity or capabilities and then serializes the full record set — including the private internal notes field — into the response body. Any field-filtering or authorization decision that should have stripped or withheld the notes is absent.

4. Post-exploitation impact. The attacker obtains the internal notes attached to booking services and categories. This is a confidential-information disclosure: the data can be used for competitive intelligence, social engineering (using internal staff/partner names against the organization), or further targeting of the booking workflow. The flaw does not by itself provide write access, privilege escalation, or remote code execution on the WordPress host, and there is no evidence in the supplied data of lateral movement capability.

Note on chaining. Because the disclosure is unauthenticated and automatic on request, it is well suited to bulk, low-noise collection across many deployments (mass scanning), which is consistent with the "unauthorized read of data from a public plugin endpoint" pattern even though EPSS currently rates exploitation likelihood as low.

Impact Assessment

Confidentiality: Primary and only material impact. Private internal notes on all booking services and categories are exposed to anonymous users. Integrity: None described. Availability: None described.

Business impact. Organizations using the plugin for customer-facing scheduling may inadvertently publish internal operating information: cost/margin data, staffing and contractor details, internal process notes, and strategic planning text. Depending on jurisdiction and sector, disclosed notes could touch regulated data (e.g., hints about customer handling procedures, partner PII, or contractual terms), potentially triggering privacy or compliance obligations even if no customer records themselves are returned.

Affected systems. Any WordPress installation running Rox Appointment Booking at a version below 1.2.8. The affected version range is taken directly from the NVD "before 1.2.8" statement. Exact lower bound and any packaging variants are not specified in the feed. Affected packages are not enumerated in OSV, and no KEV listing exists.

Blast radius. Scoped to the single vulnerable site and its booking data — there is no evidence of a multi-site or supply-chain vector. However, any site with the plugin internet-facing is remotely reachable, so the practical blast radius equals the number of unpatched deployments.

Exploitability posture. CVSS from the source: N/A (not scored). Analytical placeholder vector: network, low complexity, no privileges, no user interaction, confidentiality-only, unchanged scope. EPSS 0.00177 (7.5th percentile); not in CISA KEV; no PoC, no Nuclei template, no exploit code observed. Net assessment: low current exploitation pressure, but trivially automatable if an attacker wishes to weaponize it — mass retrieval requires no specialized tooling once endpoints are known.

Severity derived from CVSS subscores (placeholder vector). AV:N (network) and PR:N (none) maximize reachability. AC:L (low) means no special conditions. UI:N means no victim action. C:L (low) reflects limited-scope disclosure of internal notes rather than full database or credential exposure. I:N/A:N confirm no integrity or availability effect. Overall qualitative severity: low-to-moderate, driven solely by confidentiality loss through an unauthenticated public endpoint.

Detection Guidance

Detection for this class of flaw is unusual: the exploitation request is a legitimate-looking, well-formed read request with no malicious payload to signature on. Detection must therefore rely on behavioral signals — unexpected anonymous access to plugin endpoints, high-volume or sequential enumeration, and non-browser or non-booking user-agents hitting booking service/category routes — plus data-flow heuristics and correlation with response sizes. Because the exact endpoint path is not published in the supplied data, the rules below use generic WordPress plugin route conventions (e.g., /wp-json/...) and should be tailored once the specific route is known from the installed plugin version. Rules are best-effort and will require tuning.

Sigma Rule

title: Unauthenticated Access to Rox Appointment Booking Service/Category Endpoints
id: 8f3c1a2e-roxbooking-cve-2026-87907
status: experimental
description: Detects anonymous requests to Rox Appointment Booking plugin endpoints that return service and category records, indicative of CVE-2026-87907 missing-authorization data disclosure.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-87907
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_route:
    cs-method: 'GET'
    cs-uri-stem|contains:
      - '/wp-json/rox'
      - '/rox-appointment-booking'
      - 'rox-booking'
      - 'appointment-booking'
  selection_route2:
    cs-uri-query|contains:
      - 'service'
      - 'category'
      - 'notes'
  selection_noauth:
    cs(Cookie)|contains: ''      # no authenticated session cookie present
  condition: (selection_route or selection_route2) and selection_noauth
fields:
  - c-ip
  - cs-method
  - cs-uri-stem
  - cs-uri-query
  - cs(User-Agent)
falsepositives:
  - Legitimate anonymous browsing of public booking pages
  - Search engine crawlers hitting public service listings
level: medium
tags:
  - attack.t1190
  - cve.2026-87907

YARA Rule

rule CVE_2026_87907_Rox_Appointment_Booking_Missing_Auth
{
    meta:
        author = "valtersit.com"
        description = "Detects Rox Appointment Booking plugin request/response artifacts associated with CVE-2026-87907 unauthenticated data disclosure"
        cve = "CVE-2026-87907"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-87907"
        date = "2026-01-01"

    strings:
        $plugin = "rox-appointment-booking" ascii wide nocase
        $plugin2 = "rox_appointment_booking" ascii wide nocase
        $notes = "internal_notes" ascii wide nocase
        $notes2 = "private_notes" ascii wide nocase
        $json1 = "\"service\"" ascii
        $json2 = "\"category\"" ascii
        $json3 = "\"notes\"" ascii

    condition:
        (uint16be(0) != 0x504b) and
        (
            ($plugin or $plugin2) or
            (($notes or $notes2) and 2 of ($json*))
        )
}

Note: the string identifiers above are heuristic markers for plugin/response artifacts, not confirmed function or field names from the description; tune against observed traffic/logs from your own deployment.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-87907 Rox Appointment Booking Unauthenticated Service/Category Disclosure Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"appointment-booking"; http.uri; content:"service"; nocase; classtype:attempted-recon; reference:cve,2026-87907; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-87907; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:90087907; rev:1;)

alert http any any -> any any (msg:"CVE-2026-87907 Rox Booking Anonymous Category Record Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"wp-json"; http.uri; content:"rox"; nocase; http.uri; content:"category"; nocase; classtype:attempted-recon; reference:cve,2026-87907; sid:90087908; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      wildcard(http.request.path, "*appointment-booking*") ]
  [ network where network.protocol == "http" and
      http.request.method == "GET" and
      (wildcard(http.request.path, "*service*") or wildcard(http.request.path, "*category*")) and
      not exists(http.request.headers.cookie) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval is_plugin = if(match(uri, "(?i)(appointment-booking|rox-booking|wp-json/rox)"), 1, 0)
| eval is_target = if(match(uri, "(?i)(service|category|notes)"), 1, 0)
| eval anonymous = if(coalesce(cookie, "")="", 1, 0)
| where is_plugin=1 AND is_target=1 AND anonymous=1
| stats count AS req_count, dc(uri) AS unique_uris, values(uri) AS sample_uris
        by src_ip, status
| where req_count > 5 OR unique_uris > 2
| sort - req_count
| table src_ip, req_count, unique_uris, status, sample_uris

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-87907,">
  <rule id="100907" level="8">
    <decoded_as>web</decoded_as>
    <if_sid>31100</if_sid>
    <url>appointment-booking</url>
    <description>CVE-2026-87907: Request to Rox Appointment Booking plugin endpoint - possible unauthenticated service/category data disclosure.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87907,recon,</group>
  </rule>

  <rule id="100908" level="10" frequency="5" timeframe="60">
    <if_matched_sid>100907</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-87907: Repeated anonymous requests to Rox Appointment Booking endpoints (possible automated enumeration) from same source.</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_87907,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence was found in any tracked source, no vendor advisory or fix commit was provided, and no workarounds were supplied. The only remediation signal is the affected-range statement itself.

1) Immediate mitigations

• Upgrade to a fixed version once available. The NVD description defines the affected range as versions before 1.2.8; the immediate action is to install 1.2.8 or later as soon as it is verified and obtainable. Until a verified fixed build is confirmed, treat the plugin as vulnerable. (This inference rests solely on the "before 1.2.8" statement; no patch commit was supplied.)
• Restrict access to the plugin endpoints. If the booking service/category endpoints are not required to be public, block anonymous access to them at the reverse proxy / WAF / web server layer (deny unauthenticated GETs to the relevant routes). This directly addresses the missing-authorization read.
• Deploy compensating WAF rules. Use the Suricata/Elastic/Splunk/Wazuh logic above as a starting point to rate-limit or block anonymous enumeration of the plugin's booking routes.
• Reduce data sensitivity. Until patched, remove or scrub sensitive content from the "private internal notes" fields on services and categories so that any disclosure yields low-value data. This reduces the confidentiality impact to near zero.
• Isolate/disable if unused. If the plugin is not actively required, deactivate and remove it — the cleanest mitigation for a vulnerable, low-confidence plugin.

2) Patch / upgrade steps

1. Confirm the exact installed version of Rox Appointment Booking (< 1.2.8 = vulnerable).
2. Back up the site (files + database) before any change.
3. Obtain the fixed build (1.2.8+) only from the plugin's official distribution channel; verify integrity/signature before deployment.
4. Stage the upgrade in a non-production copy; validate that the booking flows still function and that the notes fields are no longer returned to anonymous callers.
5. Deploy to production; clear caches (object/page/CDN); re-verify the endpoints no longer disclose notes without authorization.
6. Track the vendor advisories and NVD page for the official patch reference and updated CVSS.

3) Long-term hardening

• Enforce a default-deny authorization model on all plugin REST/HTTP endpoints: every route must declare an explicit permission check (capability or authenticated session) appropriate to the data it returns.
• Apply response field filtering so internal-only fields (e.g., the private notes) are never serialized into public responses, even when authorization is otherwise correct — defense in depth against future access-control regressions.
• Maintain a WordPress plugin inventory and lifecycle process: track versions, subscribe to vendor/NVD feeds, and apply security updates on a defined SLA.
• Add continuous monitoring for anonymous access to sensitive plugin routes and for mass-enumeration patterns (as in the detection rules above).
• Perform periodic access-control review of custom plugin and REST code, ideally with automated tests asserting that unauthenticated requests are denied.

References

1. NVD — CVE-2026-87907: https://nvd.nist.gov/vuln/detail/CVE-2026-87907
2. CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
3. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. CISA Known Exploited Vulnerabilities Catalog (verify current status — not listed for this CVE as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS score lookup for CVE-2026-87907: https://api.first.org/data/v1/epss?cve=CVE-2026-87907

Exploit-in-the-wild / threat actor evidence: None observed. The supplied data shows no public PoC, no Nuclei template, no exploit code, EPSS 0.00177 (7.5th percentile), and no CISA KEV entry. No threat actor campaigns are associated with CVE-2026-87907 in the provided intelligence. The vulnerability is trivially automatable in principle (unauthenticated read), so monitoring for mass enumeration is still advised even at low current exploitation likelihood.

Report generated for valtersit.com. Analytical placeholder CVSS vector and severity framing are derived strictly from the described vulnerability properties (unauthenticated network-reachable read of internal notes); the authoritative CVSS value supplied in the feed is N/A. All detection rules are best-effort and require tuning against the target environment's logs and the specific plugin endpoint once confirmed.