Easy Appointments CVE-2026-61946

No special configuration or non-default settings are required beyond the Easy Appointments plugin being installed and active on a WordPress site running version ≤ 3.12.27. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any accessible default installation of the plugin within the affected version range. What limits exploitation: the CVSS C:N metric indicates private appointment data cannot be read - only mutated or deleted - so the attacker cannot harvest sensitive personally identifiable information through this vector alone. Additionally, the target site must be network-accessible and must have the plugin active; deactivating Easy Appointments removes the attack surface entirely.

The CVSS 3.1 base score of 6.5 (Medium) is driven by AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, requiring no credentials and no victim interaction - making this straightforward to script or automate. The C:N metric bounds the worst-case impact: confidential data disclosure is not in scope, so the risk is disruption and data corruption of appointment records rather than information exposure. No EPSS score was included in the provided data, so probabilistic exploitation likelihood cannot be quantified from base rates. The vulnerability is not in CISA KEV, and no POC is referenced, meaning active exploitation is unconfirmed. Real-world business impact scales with the criticality of the appointments managed - a medical practice or legal firm running Easy Appointments faces higher operational risk from unauthorized cancellations than a hobby site. The unauthenticated, low-complexity attack profile means defensive priority should be proportional to the sensitivity of the appointment data involved.

An attacker identifies a WordPress site running Easy Appointments ≤ 3.12.27 via plugin fingerprinting or public search. Without authenticating, they enumerate appointment IDs - typically sequential integers - by observing responses from the plugin's booking endpoints. The attacker submits a crafted unauthenticated request substituting another user's appointment ID, successfully modifying details or cancelling that appointment with no credentials. No POC code is referenced in the available data, but the AC:L rating indicates this is achievable with standard HTTP tooling.