CVE-2026-11992
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Easy Appointments plugin for WordPress up to version 3.12.27 is vulnerable to authorization bypass. Authenticated attackers with author-level access can cancel all future appointments site-wide by marking them as abandoned. The nonce for the cancellation request is exposed on the Appointments admin page, which is only gated by the edit_posts capability, making it accessible to low-privileged users.
Risk Assessment
The risk is the potential mass cancellation of all future appointments by an author or higher user, leading to scheduling chaos, loss of customer trust, and service disruption.
Recommendation
Immediately update the Easy Appointments plugin to the latest available version that fixes this vulnerability. Also, restrict user permissions to the minimum necessary.
Other vulnerabilities in Easy Appointments
See all- CVE-2026-61946Medium
The Easy Appointments plugin versions 3.12.27 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR).
- CVE-2026-55651High
In Easy!Appointments version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.
- CVE-2026-52841Low
A vulnerability in Easy!Appointments prior to version 1.6.0 allows any logged-in backend user (admin, provider, secretary) to hijack another provider's Google sync. The attacker can replace the OAuth token, causing customer data (name, email) to be sent to their own Google calendar.
- CVE-2026-52838Low
A stored XSS vulnerability in Easy!Appointments allows an administrator to inject malicious HTML/JavaScript into the booking disabled message field. This content is displayed unsanitized on the public booking page, affecting every unauthenticated visitor.
- CVE-2026-14225Low
A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 incorrectly validates shortcode input, allowing contributor-level users to execute arbitrary registered shortcodes.
- CVE-2026-14226Medium
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
- CVE-2026-14223Medium
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
- CVE-2026-14222Low
A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks capability and nonce checks in a connection-deletion action, allowing contributor-level users to delete booking configuration and disable the booking system.
- CVE-2026-14221Low
A vulnerability in the Easy Appointments WordPress plugin through 4.0 lacks capability checks in appointment-management actions, relying only on a nonce, allowing contributor-level users to read all customers' appointment details and to create, modify, and delete bookings.
- CVE-2026-14188Low
A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks per-request capability and nonce checks on a customer-listing handler, allowing authenticated contributor-level users to read all stored customers' personal information.
Original NVD description (English source)
The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to cancel all upcoming appointments site-wide by marking every future appointment stored by the plugin as abandoned. The nonce required to authenticate the cancellation request is printed on the Appointments admin page, which is itself gated only by the edit_posts capability that Authors possess, making the nonce readily accessible to low-privileged users.