# CVE-2026-14222: Easy Appointments WordPress plugin unauthorized connection deletion

Source: https://junglewise.ai/threats/cve-2026-14222-easy-appointments-wordpress-plugin-unauthorized-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-14222 · Severity: info · CVSS 3.8 · Published 2026-07-30

The Easy Appointments plugin for WordPress, which manages scheduling and bookings, contains a security flaw that allows low-privileged users to delete critical configuration data. An attacker with a contributor-level account could delete booking connections, effectively disabling the appointment system on the website. This could lead to operational disruptions and a loss of customer bookings.

Technologies: [Easy Appointments](https://junglewise.ai/threats/technologies/easy-appointments). Vendors: [Easy Appointments](https://junglewise.ai/threats/vendors/easy-appointments).

## Quick answers

**Is CVE-2026-14222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14222 being exploited in the wild.

**How severe is CVE-2026-14222?** Informational severity, with a CVSS score of 3.8, published 30 July 2026.

**Which products and versions are affected?** Easy Appointments <= 3.12.26.

**Is there a fix for CVE-2026-14222?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14222 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14222?** Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Easy Appointments plugin for WordPress (up to version 3.12.26) is vulnerable to missing authorization and Cross-Site Request Forgery (CSRF) in its AJAX handling. Specifically, the 'ea_delete_multiple_connections' action fails to implement nonce verification or capability checks (such as manage_options). An authenticated attacker with at least Contributor-level privileges can trigger this action to delete all booking connections. Because nonces are missing, the action is also susceptible to CSRF attacks targeting logged-in users with sufficient privileges. As of the advisory date, no patch is available.

## Affected products

- Unknown Easy Appointments <= 3.12.26

## Timeline

- 2026-07-01: disclosed: Vulnerability reported to WPScan
- 2026-07-30: advisory: CVE published to NVD

## References

- [https://wpscan.com/vulnerability/5b481b5f-c994-46b9-9315-008aae77f785/](https://wpscan.com/vulnerability/5b481b5f-c994-46b9-9315-008aae77f785/)

## Related threats

- [Easy Appointments plugin appointment cancellation token forgery](https://junglewise.ai/threats/cve-2026-87965-easy-appointments-plugin-appointment-cancellation-token-forgery)
- [Easy Appointments DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-81798-easy-appointments-dom-based-cross-site-scripting)
- [Easy Appointments WordPress plugin information disclosure in REST API](https://junglewise.ai/threats/cve-2026-14226-easy-appointments-wordpress-plugin-information-disclosure-in-rest)
- [Easy Appointments WordPress plugin IDOR in customer details retrieval](https://junglewise.ai/threats/cve-2026-14223-easy-appointments-wordpress-plugin-idor-in-customer-details)
- [Easy Appointments WordPress plugin missing authorization in appointment management](https://junglewise.ai/threats/cve-2026-14221-easy-appointments-wordpress-plugin-missing-authorization-in)