An authorization bypass vulnerability in the Easy Appointments plugin for WordPress allows authenticated attackers with low privileges to modify or delete sensitive appointment data.

This is an incorrect authorization vulnerability (CWE-863). The ea_delete_multiple_connections AJAX function fails to verify user capabilities or nonces, allowing any authenticated user to perform unauthorized deletion operations.

An attacker can manipulate scheduling data, leading to significant operational disruption and data integrity loss. While the attack requires authenticated access, the ability to modify or delete records without appropriate permissions undermines the application security model. With a CVSS score of 8.1, this vulnerability is classified as high risk, particularly for businesses relying on the plugin for appointment management.

Immediate Action: Update the Easy Appointments plugin to version 3.12.28 or later.

Proactive Monitoring: Review application logs for unusual spikes in AJAX requests or unauthorized attempts to delete appointment records.

Compensating Controls: Restrict access to administrative or sensitive functions to trusted users only and implement a WAF to monitor for unauthorized AJAX calls.

Public Exploit Available: No confirmed public exploit exists in our curated sources.

Organizations using the Easy Appointments plugin must update to the latest version promptly. Ensuring proper authorization checks are in place is critical to maintaining the integrity of appointment scheduling systems.