EUVD-2026-50982
GHSA-qw8r-6q92-c4g3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Contributor is a low-privilege WordPress role warranting PR:L, not PR:H; nonce capture requires only an authenticated session with no additional complexity.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.
AnalysisAI
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level authenticated user to perform privileged appointment-management actions - including reading all customer booking details and creating, modifying, or deleting appointments - without holding the required capabilities. The plugin relies exclusively on WordPress nonce verification as its authorization gate for these AJAX actions, but nonces are available to all authenticated users regardless of role and do not encode privilege level. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at minimum a contributor-level account on the target WordPress site (PR:L); unauthenticated visitors cannot exploit this flaw. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS score of 3.8 with PR:H significantly underrepresents real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers or compromises a contributor account on a target WordPress site running Easy Appointments. After logging in, they retrieve a valid nonce from any authenticated page in their session, then craft direct AJAX POST requests to the plugin's appointment-management actions using that nonce. … |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Easy Appointments
View allalextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
Una
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level W
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authe
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attacke
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calend
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today