Junglewise Threat Intelligence

CVE-2026-11992: Easy Appointments WordPress plugin authorization bypass

CVE-2026-11992 · Severity: medium · CVSS 4.3 · Published 2026-07-10

Technologies: Easy Appointments. Vendors: Easy Appointments.

Executive brief

The Easy Appointments plugin for WordPress, which manages booking and scheduling, contains a security flaw that allows certain users to cancel appointments they do not own. An attacker with basic 'Author' level access can cancel every upcoming appointment across the entire website. This could lead to significant operational disruption and loss of business for service providers relying on the plugin for their scheduling.

Technical details

The Easy Appointments plugin for WordPress suffers from a missing authorization check (CWE-862) in its AJAX handling logic. While the plugin uses nonces for request validation, the specific nonce required to cancel appointments is exposed on the Appointments admin page, which is accessible to any user with the 'edit_posts' capability (Authors and above). Because the plugin fails to verify if the requesting user has the appropriate administrative permissions to modify all appointments, an authenticated attacker can use the leaked nonce to mark all future appointments as abandoned. This vulnerability affects all versions up to and including 3.12.27.

Affected products

  • easyappointments Easy Appointments up to, and including, 3.12.27

Timeline

  • 2026-07-10: disclosed
  • 2026-07-10: advisory

References

Related threats