The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public /rox-appointment-booking/v1/public/booking REST endpoint performing mass-assignment of the raw request body into a new customer row while CustomerModel::$fillable includes the internal wp_user_id column, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer, SaveCustomer::handleRequest() passes the stored wp_user_id and attacker-supplied email to wp_update_user() — succeeding because LinkedAccount::canChange() unconditionally returns true when the acting user holds the edit_users capability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).
References
The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege Escalation via Mass Assignment in all versions up to, and including, 1.3.1 This is due to the public
/rox-appointment-booking/v1/public/bookingREST endpoint performing mass-assignment of the raw request body into a new customer row whileCustomerModel::$fillableincludes the internalwp_user_idcolumn, allowing an unauthenticated attacker to persist an arbitrary WordPress user ID alongside an attacker-controlled email address with no authorization check. When an administrator subsequently opens the poisoned customer record and clicks Update Customer,SaveCustomer::handleRequest()passes the storedwp_user_idand attacker-supplied email towp_update_user()— succeeding becauseLinkedAccount::canChange()unconditionally returns true when the acting user holds theedit_userscapability — thereby overwriting the targeted administrator's email address and enabling full account takeover via a standard WordPress password-reset request. Successful exploitation requires an administrator to open and save the poisoned record, and the attacker must know or guess a valid administrator user ID (such as the default user ID 1).References