Is CVE-2026-39513 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39513 being exploited in the wild.

How severe is CVE-2026-39513?

High severity, with a CVSS score of 7.5, published 15 June 2026.

Is there a fix for CVE-2026-39513?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39513 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39513?

Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39513: Easy Appointments WordPress plugin broken access control

CVE-2026-39513 · Severity: high · CVSS 7.5 · Published 2026-06-15

Easy Appointments is a WordPress plugin used to manage bookings and scheduling. A security flaw allows unauthorized individuals to bypass access controls, potentially leading to the exposure of sensitive appointment data or customer information. This could result in privacy breaches and reputational damage for businesses relying on the plugin for client management.

Technologies: Easy Appointments. Vendors: Easy Appointments.

Quick answers

Is CVE-2026-39513 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39513 being exploited in the wild.
How severe is CVE-2026-39513?: High severity, with a CVSS score of 7.5, published 15 June 2026.
Which products and versions are affected?: Easy Appointments <= 3.12.21.
Is there a fix for CVE-2026-39513?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39513 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39513?: Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Easy Appointments plugin for WordPress (versions up to and including 3.12.21) contains a broken access control vulnerability due to missing authorization checks (CWE-862). An unauthenticated remote attacker can exploit this flaw by sending crafted requests to the affected component, bypassing intended restrictions. This allows the attacker to perform actions or access data that should be restricted to higher-privileged users, specifically impacting confidentiality (CVSS C:H). The issue is resolved in version 3.12.22.

Affected products

Easy Appointments Easy Appointments <= 3.12.21

Timeline

2026-02-17: other: Reported by researcher Martín Martín
2026-04-13: advisory: Patchstack advisory published
2026-06-15: disclosed: NVD publication date

References

https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-21-broken-access-control-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.