Easy Appointments CVE-2026-87966

No special conditions - remote, unauthenticated exploitation against default configurations of the Easy Appointments WordPress plugin (versions 4.0 through <4.0.2.2). Exploitation only requires reaching the plugin's public appointment-reservation endpoint and supplying a valid appointment id; no authentication, no user interaction, and no non-default settings are needed. The only real limiting factors are that impact is confined to appointment records (overwrite/delete, no confidentiality or RCE) and that sites must be running a vulnerable version with the plugin's booking endpoint exposed.

This is a genuine, easy-to-exploit access-control flaw rather than an inflated high-CVSS paper risk, but its impact is bounded. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3 Medium) aligns with the description: a fully remote, unauthenticated, low-complexity IDOR (CWE-639) requiring no user interaction. A public exploit exists (WPScan) and a vendor patch (4.0.2.2) is available, so the fix/exploit signals are both confirmed. No EPSS score is provided and the CVE is not in CISA KEV, so there is no evidence of active or automated mass exploitation at time of analysis. The main reason this is not a critical priority is the impact ceiling: there is no confidentiality or code-execution impact - an attacker can only tamper with (overwrite) and delete arbitrary appointment records. The one signal worth scrutinizing is availability: the vendor scored A:N, yet the description explicitly says appointments can be deleted, which is a real availability loss to the business booking data - this understates the vector (see assessed vector). CPE vendor is literally 'unknown', so authoritative vendor identity is unconfirmed in the structured data.

An unauthenticated attacker sends a crafted request to the plugin's public appointment-reservation endpoint, supplying the numeric id of an appointment belonging to another customer or the business. Because the endpoint performs no ownership or authorization check, the attacker overwrites that appointment's data and, via the follow-on cleanup path, deletes arbitrary appointments - enabling booking sabotage or denial of legitimate reservations. A public proof-of-concept is available from WPScan, lowering the skill required.