Easy Appointments CVE-2026-87965

Exploitation targets the Easy Appointments plugin (before 4.0.2.2) mail-link appointment cancellation/confirmation feature, which authorizes the action with a token derived from a hardcoded, source-embedded salt plus the appointment's creation timestamp. No authentication is required (PR:N) and no user interaction is needed, but the attacker MUST know or guess the target appointment's creation timestamp to forge a valid token - this is the concrete factor limiting reliable exploitation (reflected as AC:H). Impact is bounded to cancelling or confirming existing appointments; no data disclosure or broader takeover is possible.

This is a genuine but modest-priority authorization flaw. The vendor CVSS3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L, base 4.8) is internally consistent and I agree with it: the action is remote and unauthenticated (PR:N), but AC:H is well-justified because the cancel/confirm token is derived from a hardcoded source-embedded salt combined with the appointment's creation timestamp - the attacker must know or guess that timestamp to forge a valid token. Impact is limited to integrity (I:L, flipping an appointment to cancelled/confirmed) and availability (A:L, denying a booking by cancelling it); there is no confidentiality impact (C:N), consistent with the description. Publicly available exploit code exists (WPScan), which raises real-world risk above the CVSS number alone, but this is NOT confirmed active exploitation - no CISA KEV listing and no EPSS score are provided, so widespread automated exploitation is unproven. The AC:H timestamp-guessing requirement is the primary limiter: appointments booked in a narrow, discoverable time window are far more exposed than random ones. No signals conflict with each other; the main gap is the absence of EPSS/KEV to gauge exploitation likelihood.

An unauthenticated attacker who can approximate the creation timestamp of a target appointment (e.g. by booking around the same time or observing scheduling patterns) reconstructs the cancellation/confirmation token using the publicly known hardcoded salt and that timestamp, then submits the mail-link action to cancel or confirm the victim's appointment without ever receiving the email. Public exploit code from WPScan lowers the effort required, though the AC:H timestamp-guessing step still constrains reliable mass exploitation.