What is the CVSS score of CVE-2026-39513?

CVE-2026-39513 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Easy Appointments are affected by CVE-2026-39513?

Easy Appointments WordPress plugin (versions 3.12.21 and earlier) contains an unauthenticated information disclosure vulnerability allowing remote attackers to access protected appointment data…

How to fix or mitigate CVE-2026-39513?

Within 24 hours: Immediately disable the Easy Appointments plugin and assess which appointment data may have been accessed by reviewing server logs for suspicious API requests to plugin endpoints. Within 7 days: Identify and implement an alternative appointment scheduling solution with current security maintenance, then migrate historical appointment data. Within 30 days: Deploy Web Application Firewall (WAF) rules blocking unauthenticated access to plugin database endpoints, implement database-level access logging, and establish a security monitoring alert for any reactivation of this plugin.

Easy Appointments CVE-2026-39513

EUVD-2026-36952 HIGH

Missing Authorization (CWE-862)

2026-06-15 Patchstack

GHSA-664v-gm8m-vh2f

Authentication Bypass Easy Appointments

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP request to a WordPress plugin endpoint with missing authorization; broken access control discloses sensitive data (C:H) without modifying or disrupting state.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:22 vuln.today

DescriptionCVE.org

Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

AnalysisAI

Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote attackers to access protected appointment data without authentication due to missing authorization checks. Patchstack reports the issue as a broken access control flaw with high confidentiality impact (CVSS 7.5); no public exploit identified at time of analysis, and the plugin is not currently listed in CISA KEV.

Technical ContextAI

Easy Appointments is a WordPress plugin used by service businesses to manage bookings, customer records, and scheduling. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin exposes one or more endpoints - typically WordPress REST routes, admin-ajax handlers, or plugin-specific actions - without verifying that the caller has the capability or nonce required to access the data or action. Because the CPE pins the issue to the easy_appointments product line and the CVSS vector is AV:N/PR:N, the vulnerable code path is reachable over HTTP without prior authentication to WordPress.

RemediationAI

Patch available per vendor advisory - upgrade Easy Appointments to a release later than 3.12.21 as soon as the maintainer publishes one (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-21-broken-access-control-vulnerability for the fixed version once listed) and confirm the new version via the WordPress plugin updater. As an interim compensating control, deploy a Web Application Firewall rule (Patchstack, Wordfence, or equivalent) that blocks unauthenticated requests to Easy Appointments AJAX actions and REST routes, or temporarily deactivate the plugin on production sites - accepting the trade-off of disabling online booking - and restrict access to /wp-admin/admin-ajax.php and the plugin's REST namespace to authenticated sessions via reverse-proxy ACLs where feasible.