CVE-2026-87966

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.

Score

CVSS 3.1 5.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-09-18

Last modified

2026-09-18

Weaknesses

CWE-639

Affected products

• Easy Appointments (Unknown)

References

• https://wpscan.com/vulnerability/e2e625f4-c146-4622-b439-3179c4484613/