Easy Appointments lets contributors delete the booking configuration
Easy Appointments through 3.12.26 registers the ea_delete_multiple_connections AJAX action for users passing its edit_posts registration gate but performs no per-request capability or nonce check. A Contributor can POST JSON containing an attacker-controlled ids array to /wp-admin/admin-ajax.php?action=ea_delete_multiple_connections and delete the selected connection records. Iterating IDs removes all connections, breaking the front-end booking form and disabling normal booking. The missing nonce also permits a forged request against a logged-in Contributor. The exact PHP callback name is not disclosed by the CNA advisory. Version 3.12.28 identifies and fixes unauthorized connection deletion.
- Component
- Easy Appointments
- Plugin slug
easy-appointments- Affected
- < 3.12.28
- Safe version
3.12.28- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update Easy Appointments to 3.12.28 or later. Verify that required location, service, and worker connections still exist, restore deleted booking configuration from a trusted backup if necessary, and review requests to action=ea_delete_multiple_connections from non-administrators.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L