Executive brief
The Easy Appointments WordPress plugin uses a predictable token scheme to authorize appointment cancellations and confirmations via email links. An attacker who knows an appointment's creation timestamp can forge a valid token and cancel or confirm arbitrary appointments without authorization, disrupting business operations and customer experience.
Technical details
The vulnerability is a broken access control issue (CWE-284) in the appointment confirmation/cancellation email link handler. The plugin derives authorization tokens from a hardcoded salt and the appointment's creation timestamp, rather than using cryptographically random, unguessable tokens. An unauthenticated attacker with knowledge of or ability to guess an appointment's creation timestamp can forge a valid token and modify any appointment's status via network requests to the email-link handler. No authentication or user interaction is required. The vulnerability is fixed in version 4.0.2.2.
Affected products
- Easy Appointments Easy Appointments before 4.0.2.2
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory