What is GHSA-85vh-crr4-c67p?

GHSA-85vh-crr4-c67p is a security advisory published by GitHub Security Advisories with Medium severity. The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the...

Which CVE IDs does GHSA-85vh-crr4-c67p cover?

GHSA-85vh-crr4-c67p covers the following CVE IDs: CVE-2026-87892. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-85vh-crr4-c67p?

GHSA-85vh-crr4-c67p has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-85vh-crr4-c67pMediumCVSS 5.3

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the...

Vendor

GitHub Security Advisories

Published

September 12, 2026

Last Modified

September 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-87892 →

📋 Description

The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-87892
https://wpscan.com/vulnerability/971084b9-5bf9-438a-a94d-435d1b1f01d1
https://github.com/advisories/GHSA-85vh-crr4-c67p