The Rox Appointment Booking plugin for WordPress contains a mass‑assignment flaw in its public REST endpoint (/rox-appointment-booking/v1/public/booking) that allows an unauthenticated attacker to create a customer record with an arbitrary WordPress user ID. Because the CustomerModel’s fillable list includes the internal wp_user_id field, an attacker can supply a target administrator’s user ID along with a chosen email address. When an administrator later opens and updates that customer record, the plugin passes the stored wp_user_id and attacker‑supplied email to wp_update_user(), and the plugin’s permission check (edit_users capability) allows the update to proceed. This results in the administrator’s email address being overwritten, and the attacker can then use a standard password‑reset flow to take full control of the account.

The vulnerability affects the Rox Appointment Booking – Event, Calendar & Appointment Scheduling plugin for WordPress, versions 1.3.1 and all prior releases. The plugin is made by roxnor and distributed through the WordPress plugin repository.

The vulnerability is scored CVSS 8.8, indicating a high‑severity privilege escalation. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated POST to the public booking endpoint to create a crafted customer record, followed by an administrator manually opening that record in the backend and clicking Update. The attacker must know or guess a valid administrator user ID (for example, the default ID 1), which is a modest prerequisite. Once the email is overwritten, the attacker can perform a password reset to fully compromise the administrator account.