Executive brief
Easy Appointments is a popular WordPress plugin for managing appointment bookings and reservations. An unauthenticated attacker can modify or delete any appointment in the system by directly manipulating appointment IDs, potentially disrupting business operations, canceling legitimate bookings, and damaging customer trust.
Technical details
The plugin is vulnerable to Insecure Direct Object Reference (IDOR, CWE-639) in its appointment-reservation endpoint. The vulnerability exists because the unauthenticated endpoint does not verify that the user requesting an appointment update owns or has authorization to modify that appointment. An attacker can send HTTP requests with arbitrary appointment IDs to overwrite appointment details or trigger deletion of appointments they do not own. The vulnerability affects versions 4.0 through 4.0.2.1; patch version 4.0.2.2 addresses the missing authorization checks.
Affected products
- WordPress Easy Appointments 4.0 through 4.0.2.1
Timeline
- 2026-09-16: disclosed
- 2026-09-18: advisory
- 2026-09-18: patched: Fixed in version 4.0.2.2