WordPress Appointment Plugin Mass Assignment Privilege Escalation

The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public `/rox-appointment-booking/v1/public/booking` REST endpoint performing mass-assignment of the raw request body into a new customer row while `CustomerModel::$fillable` includes the internal `wp_user_id` column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, `SaveCustomer::handleRequest()` passes the stored `wp_user_id` and attacker-supplied email to `wp_update_user()` — succeeding because `LinkedAccount::canChange()` unconditionally returns true when the acting user holds the `edit_users` capability — thereby overwriting the targeted administrator's email address and en

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Rox Appointment Booking plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions through 1.3.1. An unauthenticated attacker can exploit a mass assignment flaw in the public REST API endpoint `/rox-appointment-booking/v1/public/booking` to arbitrarily set the `wp_user_id` field when creating customer records. By crafting a malicious request with an elevated WordPress user ID, attackers can escalate privileges without authentication, gaining unauthorized administrative access to affected WordPress installations. This vulnerability is particularly dangerous because it requires no prior authentication and can be exploited by any internet-connected user, making it an immediate threat to any WordPress site running this plugin.

Casky's 224 matching security skills enable practitioners to detect this attack through Claude's extended reasoning capabilities focused on MITRE ATT&CK TA0004 (Privilege Escalation) techniques. Practitioners would observe detection findings highlighting mass assignment patterns in REST API traffic, suspicious `wp_user_id` parameters in booking endpoint requests, and unauthorized privilege elevation events in WordPress audit logs. The platform would correlate unauthenticated requests to the vulnerable endpoint with subsequent administrative user creation or privilege changes, exposing the attack chain. By mapping these indicators to CWE-269 (Improper Access Control), Casky helps security teams identify exploitation attempts in real-time and trace the exact request patterns used to manipulate customer data fields during the booking process.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-104012.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-104012

Casky has 224 skills that investigate the attack patterns behind CVE-2026-104012. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn