{"metadata": {"vulnerability": "CVE-2026-104012", "count": 18, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 10}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-01T16:42:36.171Z", "date_only": false, "value": "2026-10-01T16:42:36.171Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T10:02:19Z", "date_only": false, "value": "2026-10-11T10:02:19.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104012", "field": "containers.cna.timeline.0.time", "text": "Vendor Notified"}, {"timestamp": "2026-10-30T19:18:58Z", "date_only": false, "value": "2026-10-30T19:18:58.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104012", "field": "containers.cna.timeline.1.time", "text": "Disclosed"}, {"timestamp": "2026-10-31T07:46:47.528Z", "date_only": false, "value": "2026-10-31T07:46:47.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-31T07:46:47.528Z", "date_only": false, "value": "2026-10-31T07:46:47.528Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-104012", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-31T07:54:35.766Z", "date_only": false, "value": "2026-10-31T07:54:35.766693Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117534443111058246", "record": "CVE-2026-104012", "field": "creation_timestamp", "uuid": "11fa2fca-b16a-47e2-b6b0-1fc18afc0273", "content": "CVE-2026-104012 Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint The Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` \u2014 succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability \u2014 thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).\nhttps://www.cve.org/CVERecord?id=CVE-2026-104012https://www.wordfence.com/threat-intel/vulnerabilities/id/2a32f428-fa6e-469b-b004-e80a1029af80?source=cvehttps://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/REST/SaveCustomer.php#L262https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/Services/CustomerService.php#L74https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/Customer/Data/CustomerModel.php#L38https://plugins.trac.wordpress.org/browser/rox-appointment-booking/tags/1.3.0/src/Modules/FrontendBookingPanel/REST/BookingConfirm.php#L61https://downloads.wordpress.org/plugin/rox-appointment-booking.1.3.2.zip#wordpress #roxnor #RoxAppointmentBooking\u2013Event,Calendar&AppointmentScheduling#CVE_2026_104012#bot", "url": "https://infosec.exchange/users/cve/statuses/117534443111058246"}, {"timestamp": "2026-10-31T08:16:47Z", "date_only": false, "value": "2026-10-31T08:16:47Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-8CR7-X3XR-PPW5", "record": "GHSA-8CR7-X3XR-PPW5", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-31T08:16:47.893Z", "date_only": false, "value": "2026-10-31T08:16:47.893", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104012", "record": "FKIE_CVE-2026-104012", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-8CR7-X3XR-PPW5", "record": "GHSA-8CR7-X3XR-PPW5", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-31T09:31:13Z", "date_only": false, "value": "2026-10-31T09:31:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-8CR7-X3XR-PPW5", "record": "GHSA-8CR7-X3XR-PPW5", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-31T09:40:15.507Z", "date_only": false, "value": "2026-10-31T09:40:15.507303Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/4t57z6mitayv4", "record": "CVE-2026-104012", "field": "creation_timestamp", "uuid": "8355603b-e899-4e89-b0ca-a8dca7489c3a", "content": "CVE-2026-104012 - Rox Appointment Booking\nCVE ID : CVE-2026-104012\n \n Published : Oct. 31, 2026, 7:46 a.m. | 14\u00a0minutes ago\n \n Description : The Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mas...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/4t57z6mitayv4"}, {"timestamp": "2026-10-31T17:01:25.372Z", "date_only": false, "value": "2026-10-31T17:01:25.372208Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz6rihkdth26", "record": "CVE-2026-104012", "field": "creation_timestamp", "uuid": "4bfcda63-4b57-417d-997e-3c91e17ffd1c", "content": "\ud83d\udfe0 CVE-2026-104012 - High (8.8)\n\nThe Rox Appointment Booking \u2013 Appointment Booking Scheduling Solution plugin for WordPress is v...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-104012/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mz6rihkdth26"}, {"timestamp": "2026-11-02T00:00:23.445Z", "date_only": false, "value": "2026-11-02T00:00:23.445315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pulse-wp.com/post/3mzbzegdixn2b", "record": "CVE-2026-104012", "field": "creation_timestamp", "uuid": "fb3855a9-595a-4dc8-9ad6-4bbacda69662", "content": "Any visitor escalates to admin. Mass assignment flaw in Rox Appointment Booking up to 1.3.1. CVE-2026-104012, 8.8/10. They control your site. Update now. Scan your WordPress site: pulse-wp.com\n#WordPress #AccessControl #CyberSecurity", "url": "https://bsky.app/profile/pulse-wp.com/post/3mzbzegdixn2b"}, {"timestamp": "2026-11-02T14:50:55.700Z", "date_only": false, "value": "2026-11-02T14:50:55.700006Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104012", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-11-02T14:50:55.700Z", "date_only": false, "value": "2026-11-02T14:50:55.700006Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104012", "record": "FKIE_CVE-2026-104012", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-11-02T14:51:04.867Z", "date_only": false, "value": "2026-11-02T14:51:04.867Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-02T14:51:04.867Z", "date_only": false, "value": "2026-11-02T14:51:04.867Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-104012", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-02T16:19:19.997Z", "date_only": false, "value": "2026-11-02T16:19:19.997", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104012", "record": "FKIE_CVE-2026-104012", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T17:20:37.462Z", "anchors": {"origin": {"timestamp": "2026-10-31T07:46:47.528Z", "date_only": false, "value": "2026-10-31T07:46:47.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-31T07:46:47.528Z", "date_only": false, "value": "2026-10-31T07:46:47.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 984829.934278, "hours": 273.56387063277776, "days": 11.398494609699075, "min_seconds": 984829.934278, "max_seconds": 984829.934278, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-31T07:46:47.528Z", "date_only": false, "value": "2026-10-31T07:46:47.528Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104012", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T17:20:37.462Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}