Rox Appointment Booking Event Calendar Appointment Scheduling
Monthly
Unauthenticated attackers can escalate to administrator account takeover on WordPress sites running Rox Appointment Booking 1.3.1 and earlier, because the plugin's public booking REST route mass-assigns the raw request body into a customer record whose fillable fields include the internal wp_user_id column. An attacker can seed a poisoned customer row carrying an arbitrary administrator user ID (user ID 1 is a reliable guess) plus an email address they control, but the takeover only completes when an administrator later opens that record and clicks Update Customer, at which point the stored wp_user_id and attacker-supplied email are handed to wp_update_user() and the administrator's email is overwritten, enabling a standard WordPress password reset. The attack is network-reachable and needs no credentials, though the mandatory administrator interaction and the user-ID guess bound real-world exploitation; there is no CISA KEV listing, no confirmed public exploit code, and the fix is the vendor's 1.3.2 release.
Unauthenticated attackers can escalate to administrator account takeover on WordPress sites running Rox Appointment Booking 1.3.1 and earlier, because the plugin's public booking REST route mass-assigns the raw request body into a customer record whose fillable fields include the internal wp_user_id column. An attacker can seed a poisoned customer row carrying an arbitrary administrator user ID (user ID 1 is a reliable guess) plus an email address they control, but the takeover only completes when an administrator later opens that record and clicks Update Customer, at which point the stored wp_user_id and attacker-supplied email are handed to wp_update_user() and the administrator's email is overwritten, enabling a standard WordPress password reset. The attack is network-reachable and needs no credentials, though the mandatory administrator interaction and the user-ID guess bound real-world exploitation; there is no CISA KEV listing, no confirmed public exploit code, and the fix is the vendor's 1.3.2 release.