# CVE-2026-87965: Easy Appointments plugin appointment cancellation token forgery

Source: https://junglewise.ai/threats/cve-2026-87965-easy-appointments-plugin-appointment-cancellation-token-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87965 · Severity: medium · CVSS 4.8 · Published 2026-09-18

The Easy Appointments WordPress plugin uses a predictable token scheme to authorize appointment cancellations and confirmations via email links. An attacker who knows an appointment's creation timestamp can forge a valid token and cancel or confirm arbitrary appointments without authorization, disrupting business operations and customer experience.

Technologies: [Easy Appointments](https://junglewise.ai/threats/technologies/easy-appointments). Vendors: [Easy Appointments](https://junglewise.ai/threats/vendors/easy-appointments).

## Quick answers

**Is CVE-2026-87965 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87965 being exploited in the wild.

**How severe is CVE-2026-87965?** Medium severity, with a CVSS score of 4.8, published 18 September 2026.

**Which products and versions are affected?** Easy Appointments before 4.0.2.2.

**Is there a fix for CVE-2026-87965?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87965 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-87965?** Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a broken access control issue (CWE-284) in the appointment confirmation/cancellation email link handler. The plugin derives authorization tokens from a hardcoded salt and the appointment's creation timestamp, rather than using cryptographically random, unguessable tokens. An unauthenticated attacker with knowledge of or ability to guess an appointment's creation timestamp can forge a valid token and modify any appointment's status via network requests to the email-link handler. No authentication or user interaction is required. The vulnerability is fixed in version 4.0.2.2.

## Affected products

- Easy Appointments Easy Appointments before 4.0.2.2

## Timeline

- 2026-09-16: disclosed
- 2026-09-18: advisory

## References

- [https://wpscan.com/vulnerability/b498fba8-8969-45af-8cef-e91d6be34912/](https://wpscan.com/vulnerability/b498fba8-8969-45af-8cef-e91d6be34912/)

## Related threats

- [Easy Appointments DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-81798-easy-appointments-dom-based-cross-site-scripting)
- [Easy Appointments WordPress plugin information disclosure in REST API](https://junglewise.ai/threats/cve-2026-14226-easy-appointments-wordpress-plugin-information-disclosure-in-rest)
- [Easy Appointments WordPress plugin IDOR in customer details retrieval](https://junglewise.ai/threats/cve-2026-14223-easy-appointments-wordpress-plugin-idor-in-customer-details)
- [Easy Appointments WordPress plugin unauthorized connection deletion](https://junglewise.ai/threats/cve-2026-14222-easy-appointments-wordpress-plugin-unauthorized-connection)
- [Easy Appointments WordPress plugin missing authorization in appointment management](https://junglewise.ai/threats/cve-2026-14221-easy-appointments-wordpress-plugin-missing-authorization-in)