EUVD-2026-42850
GHSA-xfx8-39w8-9g2h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Author-level auth required (PR:L); attacker can modify ALL appointment records (I:H, not I:L); no confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to cancel all upcoming appointments site-wide by marking every future appointment stored by the plugin as abandoned. The nonce required to authenticate the cancellation request is printed on the Appointments admin page, which is itself gated only by the edit_posts capability that Authors possess, making the nonce readily accessible to low-privileged users.
AnalysisAI
Authorization bypass in the Easy Appointments WordPress plugin (all versions up to and including 3.12.27) permits any authenticated user holding the Author role or above to mass-cancel every future appointment across the entire site by exploiting a missing capability check on the plugin's AJAX cancellation handler. The attack is made trivially accessible because the nonce required to authenticate the cancellation request is rendered directly on the Appointments admin page, which is gated only by the edit_posts capability that Authors possess by default. No public exploit has been identified at time of analysis, but the low privilege barrier and deterministic exploit path present a high-consequence business-disruption risk for any organization running booking workflows on affected installations.
Technical ContextAI
The vulnerability resides in the Easy Appointments WordPress plugin's AJAX dispatch layer, specifically in src/ajax.php at lines approximately 180, 563, and 619 (confirmed via WordPress plugin SVN trac references for tags 3.12.24.1 and 3.12.25). CWE-862 (Missing Authorization) describes the root cause: the AJAX handler verifies nonce validity to prevent CSRF but does not perform a separate capability check to confirm the requesting user holds sufficient privilege to issue a site-wide cancellation. In WordPress, nonce verification establishes authenticity of the request origin but is architecturally distinct from authorization. The nonce itself is exposed in src/templates/appointments.tpl.php at line 302, rendered inside the Appointments admin page. Because that admin page is gated only by edit_posts - a capability assigned by default to the Author role and above - any Author can obtain the nonce and subsequently trigger the mass-abandonment action. The affected CPE is cpe:2.3:a:easyappointments:easy_appointments:*:*:*:*:*:*:*:*.
RemediationAI
No vendor-released patched version has been confirmed in the available data - administrators should monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/eea33d0b-2547-4c51-8c4c-d178d6c8502d and the WordPress plugin repository for a patched release and upgrade immediately upon availability. As an immediate compensating control, administrators should audit and reduce the number of Author-level (and above) accounts to only operationally trusted users, since the attack requires at minimum that role. Disabling open user registration (Settings > General > uncheck 'Anyone can register') eliminates the most common path to acquiring Author-level access and should be applied if registration is not a required site function. Additionally, a Web Application Firewall rule blocking the specific AJAX action for appointment mass-cancellation (if identifiable from the ajax.php handler names) can provide a perimeter layer of defense with no functional side effects for legitimate users. Note that restricting the edit_posts capability from the Author role via a role-editor plugin is possible but may break other plugin or theme functionality that legitimately relies on that capability.
More in Easyappointments
View allAn issue in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to escalate privileges via the index.php f
Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated critical severi
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments p
Session Fixation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS 8.8), th
API Privilege Escalation in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated high severity (CVSS
alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Cross-Site Request Forgery (CSRF) in Easy!Appointments 1.5.2 and earlier allows remote attackers to perform administrati
Cross Site Scripting vulnerability in Alex Tselegidis EasyAppointments v.1.5.0 allows a remote attacker to execute arbit
Improper Access Control in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Cross-site Scripting (XSS) - Stored in GitHub repository alextselegidis/easyappointments prior to 1.5.0. Rated medium se
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today