Skip to main content

Easy Appointments EUVDEUVD-2026-50983

| CVE-2026-14222 LOW
Improper Access Control (CWE-284)
2026-07-30 WPScan GHSA-hc6v-wvgv-hh32
WordPress Authentication Bypass Easy Appointments
3.8
CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY
3.8 LOW
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
vuln.today AI
5.4 MEDIUM

Contributor-level WordPress access is PR:L, not PR:H; no confidentiality impact; integrity and availability both low due to config deletion only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
Analysis Generated
Jul 30, 2026 - 19:33 vuln.today
CVSS changed
Jul 30, 2026 - 19:22 NVD
3.8 (LOW)
CVE Published
Jul 30, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 30, 2026 - 06:00 cve.org
LOW 3.8

DescriptionCVE.org

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.

AnalysisAI

Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level WordPress user to delete the site's booking configuration and functionally disable the appointment system. The vulnerable action handler performs neither a WordPress capability check nor nonce validation, meaning any authenticated user at or above contributor role can trigger the deletion without administrative approval. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain or register contributor-level WordPress account
Delivery
Identify target site running Easy Appointments ≤3.12.26
Exploit
Send crafted HTTP request to unprotected connection-deletion action
Execution
Server executes deletion without capability or nonce check
Persist
Booking configuration deleted
Impact
Appointment system disabled for all users
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires an authenticated WordPress session with at minimum contributor-level privileges - this is the lowest dashboard-capable role in WordPress and is commonly granted to guest bloggers or content contributors. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L, score 3.8) contains a significant inconsistency with the CVE description: PR:H implies administrator-level privilege, yet the description explicitly states contributor-level access is sufficient. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker registers or compromises a contributor-level WordPress account on a target site running Easy Appointments ≤3.12.26. Using the publicly available WPScan PoC, they send a crafted HTTP request to the plugin's unprotected connection-deletion action endpoint. …
Remediation No vendor-released patched version is independently confirmed from available data at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Easy Appointments

View all
CVE-2025-50383 HIGH POC
8.1 Aug 25

alextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
CVE-2026-14224 MEDIUM POC
5.4 Jul 29

Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets

CVE-2019-14936 MEDIUM POC
5.3 Sep 11

Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
CVE-2026-14226 MEDIUM POC
4.3 Jul 30

Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
CVE-2026-14223 MEDIUM POC
4.3 Jul 30

Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
CVE-2026-8789 HIGH
8.1 Jul 24

Una
CVE-2026-14221 LOW POC
3.8 Jul 30

Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level au
CVE-2025-29448 HIGH
7.5 May 07

Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively

CVE-2026-39513 HIGH
7.5 Jun 15

Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
CVE-2026-14188 LOW POC
2.7 Jul 30

Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authe
CVE-2026-61946 MEDIUM
6.5 Jul 23

Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attacke
CVE-2024-2842 MEDIUM
6.4 Mar 29

The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calend

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-50983 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy