Is CVE-2026-61946 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61946 being exploited in the wild.

How severe is CVE-2026-61946?

Medium severity, with a CVSS score of 6.5, published 23 July 2026.

Is there a fix for CVE-2026-61946?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-61946 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-61946?

Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61946: Easy Appointments IDOR in WordPress plugin

CVE-2026-61946 · Severity: medium · CVSS 6.5 · Published 2026-07-23

Easy Appointments is a WordPress plugin used to manage bookings and scheduling. A security flaw allows unauthenticated users to access or modify data they should not have permission to see by manipulating object identifiers. This could lead to unauthorized changes to appointments or interference with the booking database, potentially disrupting business operations and customer scheduling.

Technologies: Easy Appointments. Vendors: Easy Appointments.

Quick answers

Is CVE-2026-61946 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61946 being exploited in the wild.
How severe is CVE-2026-61946?: Medium severity, with a CVSS score of 6.5, published 23 July 2026.
Which products and versions are affected?: Easy Appointments <= 3.12.27.
Is there a fix for CVE-2026-61946?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-61946 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-61946?: Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Easy Appointments plugin for WordPress through version 3.12.27. The flaw is categorized as CWE-639, where the application fails to properly validate authorization when a user-controlled key is used to access a database object. An unauthenticated remote attacker can exploit this by manipulating input parameters to bypass authorization checks. This may allow the attacker to interact with the database or modify records without valid credentials. The issue is resolved in version 3.12.28.

Affected products

Easy Appointments Easy Appointments <= 3.12.27

Timeline

2026-04-03: other: Vulnerability reported by Daniel Wade
2026-07-16: advisory: Patchstack published advisory details
2026-07-23: disclosed: CVE published to NVD dataset

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.