CVE-2026-87966: Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/Easy Appointmentsto a version that resolves this vulnerability.Fixed in 4.0.2.2
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated appointment changes or deletion?
WordPress sites running Easy Appointments versions before 4.0.2.2 are affected. The vulnerable appointment-reservation endpoint is unauthenticated, so an attacker does not need an account to target appointments.
What does an attacker need to modify a particular appointment?
The attacker needs to supply the identifier of an existing appointment in a request to the reservation endpoint. The endpoint does not verify ownership or authorization before updating the appointment associated with that supplied ID.
Can this issue result in appointment deletion as well as modification?
Yes. An attacker can overwrite an arbitrary appointment and then trigger follow-on cleanup behavior that deletes it.