Easy Appointments CVE-2026-14222

Exploitation requires an authenticated WordPress session with at minimum contributor-level privileges - this is the lowest dashboard-capable role in WordPress and is commonly granted to guest bloggers or content contributors. No special plugin configuration, non-default settings, or elevated system access is needed beyond this role. On sites where open user registration is enabled (a common WordPress configuration), an attacker may self-register and obtain contributor access without any prior relationship with the site. The scope of damage is limited to deletion of booking connection data and disruption of the appointment system - exploitation does not yield code execution, data exfiltration, or persistent backdoor access. Sites where contributor registration is locked down to vetted individuals face significantly reduced real-world risk despite the network-accessible vector.

The NVD-assigned CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L, score 3.8) contains a significant inconsistency with the CVE description: PR:H implies administrator-level privilege, yet the description explicitly states contributor-level access is sufficient. Contributor is one of WordPress's lowest privilege tiers, making PR:L the more accurate metric - this discrepancy materially understates exploitability. A corrected PR:L vector yields a higher base score and lowers the effective bar for attackers. EPSS at 0.15% (5th percentile) indicates low observed exploitation at time of analysis, consistent with the niche impact (availability disruption only, no exfiltration). The existence of a public WPScan PoC lowers the skill threshold for exploitation. The impact is bounded - no confidentiality loss, no code execution - but could cause significant business disruption for sites relying on the booking system. This is a medium-priority issue for sites with open contributor registration and high for managed WordPress environments where contributors are not fully trusted.

An attacker registers or compromises a contributor-level WordPress account on a target site running Easy Appointments ≤3.12.26. Using the publicly available WPScan PoC, they send a crafted HTTP request to the plugin's unprotected connection-deletion action endpoint. Without any server-side capability or nonce validation, the request is accepted and the booking configuration is deleted, taking the appointment system offline for all site visitors and administrators until manually reconfigured.