3.8
Low
CVE-2026-14222 The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its…
Description
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Easy Appointments 3.12 | earliest → < 3.12.28 | 3.12.28 |
Other CVEs of Easy Appointments
The 11 CVEs of Easy Appointments →
CVE-2026-87965
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link…
4.8
Medium
CVE-2026-87966
The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its…
5.3
Medium
CVE-2026-19406
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to…
2.7
Low
CVE-2026-14225
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its…
2.7
Low