Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Easy Appointments 4.0.2.2 Clear all filters
TI-2026-60005 CVE-2026-87966 · GHSA-52p7-4rrr-jvcv

Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

Priority LOW 30

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a r…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-09-18 Fixed in 4.0.2.2 CWE-639
TI-2026-60004 CVE-2026-87965 · GHSA-w73j-m9cj-hp9q

Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation via Forgeable Email-Link Token

Priority LOW 22

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded sal…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00272 Published 2026-09-18 Fixed in 4.0.2.2 CWE-284