EUVD-2026-82675

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87966 Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOR

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

WordPress Easy Appointments plugin 4.0-4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability

Unauthenticated Arbitrary Appointment Modification and Deletion vulnerability discovered by blast in WordPress Plugin Easy Appointments versions 4.0-4.0.2.1...

WordPress Easy Appointments plugin < 4.0.2.2 - Unauthenticated Appointment Cancellation/Confirmation vulnerability

Unauthenticated Appointment Cancellation/Confirmation vulnerability discovered by Morato Antoine in WordPress Plugin Easy Appointments versions 4.0.2.2...

CVE-2026-87966

The Easy Appointments WordPress plugin, in versions 4.0 through 4.0.2.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to perform sufficient ownership or authorization checks on its unauthenticated appointment-reservation endpoint. This oversight allows an u...

CVE-2026-87965: Improper Access Control

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...

CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

PT-2026-95254

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 Description An authorization check is missing in an appointment-retrieval action. This allows users with a low-privilege role specific to the plugin to access...

CVE-2026-89008: Exposure of Sensitive Information to an Unauthorized Actor

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...

CVE-2026-89007: Missing Authorization

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

PT-2026-95247

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 4.0.2.2 Description The plugin fails to use an unguessable token to authorize appointment cancellation and confirmation actions via mail-links. The token is derived from a hardcoded source-embedded salt and...

PT-2026-95248

Name of the Vulnerable Software and Affected Versions Easy Appointments versions 4.0 through 4.0.2.1 Description The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete...

PT-2026-95253

Name of the Vulnerable Software and Affected Versions Bookit — Booking & Appointment Calendar WordPress plugin versions prior to 2.6.0.5 Description An issue exists where the plugin fails to perform a capability check within an appointment-deletion function. This allows users assigned to the...

CVE-2026-87966: Authorization Bypass Through User-Controlled Key

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

PT-2026-95132

Name of the Vulnerable Software and Affected Versions Booking for Appointments and Events Calendar – Amelia versions prior to 2.4.6 Description The plugin allows unauthenticated attackers to create approved appointment bookings without completing payment. This occurs because the software accepts ...

WordPress Appointment Hour Booking plugin < 1.5.95 - Unauthenticated Booking Capacity Bypass vulnerability

Unauthenticated Booking Capacity Bypass vulnerability discovered by Nicat in WordPress Plugin Appointment Hour Booking versions 1.5.95...

CVE-2026-86475

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...

CVE-2026-86475

Appointment Hour Booking is a WordPress plugin that allows scheduling of time-based appointments. Versions prior to 1.5.95 are affected by a capacity validation flaw: when a multi-appointment booking submission is received, the plugin does not verify each individual appointment against the capaci...

EUVD-2026-80220

The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked...