8 matches found
CVE-2026-14222
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
EUVD-2026-50983
The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
CVE-2026-14222 Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
CVE-2026-14222
The Easy Appointments WordPress plugin (versions before 3.12.28 ) is vulnerable to an improper access control flaw. The plugin fails to perform necessary capability or nonce checks during specific connection-deletion actions. This allows users with contributor-level access to delete the booking c...
CVE-2026-14222
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
PT-2026-66381
The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
CVE-2026-14222: Improper Access Control
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...
CVE-2026-11866
The Appointment Booking Plugin for WordPress (versions prior to 5.6.3 ) is vulnerable to Cross-Site Request Forgery (CSRF) . The root cause is a failure to validate a CSRF nonce on multiple state-changing actions managed by the plugin's central request dispatcher. A successful attack against a lo...