WordPress Plugin Vulnerabilities

Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

Description

The plugin does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.

Proof of Concept

Affects Plugins

Plugin icon
easy-appointments
Fixed in 4.0.2.2

References

CVE
CVE-2026-87966

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
blast
Submitter
blast
Submitter twitter
Biner_1
Verified
Yes
WPVDB ID
e2e625f4-c146-4622-b439-3179c4484613

Timeline

Publicly Published
2026-09-16 (about 2 days ago)
Added
2026-09-16 (about 1 day ago)
Last Updated
2026-09-16 (about 1 day ago)

Other

Published
Title
Published
2024-05-30
Title
Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access
Published
2025-10-21
Title
Flexible Refund and Return Order for WooCommerce < 1.0.39 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund
Published
2026-05-27
Title
Timetable and Event Schedule by MotoPress < 2.4.17 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via action_get_event_data Function
Published
2026-08-17
Title
Eventin < 4.1.21 - Contributor+ Schedule Deletion and Modification via IDOR
Published
2026-07-20
Title
Event Tickets < 5.29.0.1 - Contributor+ Seating Layout and Ticket Inventory Modification via IDOR