Veille CVE

Recherche « Unknown Easy Appointments »

3 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown Easy Appointments » ✕
  1. CVE-2026-87966 5.3 Moyenne

    Unknown Easy Appointments

    The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.

  2. CVE-2026-87965 4.8 Moyenne

    Unknown Easy Appointments

    The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.

  3. CVE-2026-19406 2.7 Faible

    Unknown Easy Appointments

    The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.