medium5.3
CVE-2026-87966
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpo…
Impact
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.
Affected products
| Product | Affected versions |
|---|---|
| Easy Appointments WordPress Plugin | before 4.0.2.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.