What is the CVSS score of EUVD-2026-48204?

EUVD-2026-48204 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.2%.

Easy Appointments EUVD-2026-48204

| CVE-2026-61946 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-23 Patchstack

GHSA-q6pv-j4x7-8qh4

Authentication Bypass Easy Appointments

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Unauthenticated network IDOR with no confidentiality impact; exploitation only mutates or removes appointment records, justifying I:L and A:L with C:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:31 vuln.today

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.

AnalysisAI

Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attackers manipulate appointment records belonging to other users by substituting predictable object identifiers in plugin endpoints. The CWE-639 root cause - Authorization Bypass Through User-Controlled Key - means ownership checks are entirely absent at the pre-authentication layer, consistent with the 'Authentication Bypass' tag in the Patchstack report. No public exploit code or CISA KEV listing was identified at time of analysis; no public exploit identified at time of analysis.

Technical ContextAI

Easy Appointments is a WordPress appointment-scheduling plugin (CPE: cpe:2.3:a:easy_appointments:easy_appointments:*:*:*:*:*:*:*:*). CWE-639 describes a failure to verify that the requesting party owns the object they reference - the plugin exposes HTTP endpoints that accept user-supplied appointment IDs but perform no server-side ownership validation before executing write or delete operations on those records. Because the vulnerability is tagged both 'Authentication Bypass' and 'IDOR', the access-control gap exists entirely at the pre-authentication layer: session validation is either absent or bypassable for the affected plugin operations. The CVSS impact metrics (C:N/I:L/A:L) are consistent with endpoints that mutate or remove records rather than disclose them, suggesting the exploitable surface is write and delete functionality rather than read.

RemediationAI

Upgrade the Easy Appointments plugin to the latest version available in the WordPress plugin repository - any version released after 3.12.27 should incorporate the fix per the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-27-insecure-direct-object-references-idor-vulnerability?_s_id=cve; the exact patched version number is not independently confirmed from the provided data, so verify the plugin changelog before deployment. If an immediate upgrade is not feasible, a compensating control is to place the plugin's AJAX or REST API endpoints behind mandatory authentication at the web server or WAF layer - note this may break legitimate unauthenticated booking workflows and should be tested against the expected user experience before enabling. Sites enrolled in Patchstack's service can apply virtual patching rules as an interim measure until the plugin can be updated.