Skip to main content

Easy Appointments CVE-2026-8789

| EUVDEUVD-2026-48600 HIGH
Incorrect Authorization (CWE-863)
2026-07-24 Wordfence GHSA-xxw4-4rgm-pwm2
Authentication Bypass WordPress Easy Appointments
8.1
CVSS 3.1 · Vendor: Wordfence
Share

Severity by source

Vendor (Wordfence) PRIMARY
8.1 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 26, 2026 - 11:46 vuln.today
CVE Published
Jul 24, 2026 - 14:34 cve.org
HIGH 8.1

DescriptionCVE.org

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the ea_delete_multiple_connections AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the wp_ea_connections table, disrupting the plugin's core booking functionality.

AnalysisAI

Una

More in Easy Appointments

View all
CVE-2025-50383 HIGH POC
8.1 Aug 25

alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
CVE-2026-14224 MEDIUM POC
5.4 Jul 29

Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets

CVE-2019-14936 MEDIUM POC
5.3 Sep 11

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
CVE-2026-14226 MEDIUM POC
4.3 Jul 30

Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
CVE-2026-14223 MEDIUM POC
4.3 Jul 30

Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
CVE-2026-14222 LOW POC
3.8 Jul 30

Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level W
CVE-2026-14221 LOW POC
3.8 Jul 30

Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level au
CVE-2025-29448 HIGH
7.5 May 07

Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively

CVE-2026-39513 HIGH
7.5 Jun 15

Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
CVE-2026-14188 LOW POC
2.7 Jul 30

Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authe
CVE-2026-61946 MEDIUM
6.5 Jul 23

Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attacke
CVE-2024-2842 MEDIUM
6.4 Mar 29

The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calend

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-8789 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy