# CVE-2026-11992: Easy Appointments WordPress plugin authorization bypass

Source: https://junglewise.ai/threats/cve-2026-11992-easy-appointments-wordpress-plugin-authorization-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-11992 · Severity: medium · CVSS 4.3 · Published 2026-07-10

The Easy Appointments plugin for WordPress, which manages booking and scheduling, contains a security flaw that allows certain users to cancel appointments they do not own. An attacker with basic 'Author' level access can cancel every upcoming appointment across the entire website. This could lead to significant operational disruption and loss of business for service providers relying on the plugin for their scheduling.

Technologies: [Easy Appointments](https://junglewise.ai/threats/technologies/easy-appointments). Vendors: [Easy Appointments](https://junglewise.ai/threats/vendors/easy-appointments).

## Quick answers

**Is CVE-2026-11992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11992 being exploited in the wild.

**How severe is CVE-2026-11992?** Medium severity, with a CVSS score of 4.3, published 10 July 2026.

**Which products and versions are affected?** Easy Appointments up to, and including, 3.12.27.

**Is there a fix for CVE-2026-11992?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-11992 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11992?** Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Easy Appointments plugin for WordPress suffers from a missing authorization check (CWE-862) in its AJAX handling logic. While the plugin uses nonces for request validation, the specific nonce required to cancel appointments is exposed on the Appointments admin page, which is accessible to any user with the 'edit_posts' capability (Authors and above). Because the plugin fails to verify if the requesting user has the appropriate administrative permissions to modify all appointments, an authenticated attacker can use the leaked nonce to mark all future appointments as abandoned. This vulnerability affects all versions up to and including 3.12.27.

## Affected products

- easyappointments Easy Appointments up to, and including, 3.12.27

## Timeline

- 2026-07-10: disclosed
- 2026-07-10: advisory

## References

- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/ajax.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/templates/appointments.tpl.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.24.1/src/templates/appointments.tpl.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php)
- [https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php](https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php)

## Related threats

- [Easy Appointments plugin appointment cancellation token forgery](https://junglewise.ai/threats/cve-2026-87965-easy-appointments-plugin-appointment-cancellation-token-forgery)
- [Easy Appointments DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-81798-easy-appointments-dom-based-cross-site-scripting)
- [Easy Appointments WordPress plugin information disclosure in REST API](https://junglewise.ai/threats/cve-2026-14226-easy-appointments-wordpress-plugin-information-disclosure-in-rest)
- [Easy Appointments WordPress plugin IDOR in customer details retrieval](https://junglewise.ai/threats/cve-2026-14223-easy-appointments-wordpress-plugin-idor-in-customer-details)
- [Easy Appointments WordPress plugin unauthorized connection deletion](https://junglewise.ai/threats/cve-2026-14222-easy-appointments-wordpress-plugin-unauthorized-connection)