Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Payment Bypass in all versions up to 1.2.0. This is due to missing server-side verification of the order total and payment method, with the client-submitted amount used directly for billing instead of prices calculated from the database. This makes it possible for unauthenticated attackers to create confirmed bookings at an arbitrary price and bypass configured payment-method restrictions by submitting a tampered amount in the booking request.

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: Rox Appointment Booking 1.2.0 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts