{"id":"CVE-2026-14222","aliases":["EUVD-2026-50983","GHSA-hc6v-wvgv-hh32"],"status":"published","title":"Easy Appointments \u003c 3.12.28 - Contributor+ Connection Deletion via Missing Authorization","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00318,"percentile":0.25085,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-07-30T06:00:05Z","modified":"2026-08-10T13:17:57Z","products":[{"vendor":"easyappointments","product":"easy appointments"},{"vendor":"unknown","product":"easy appointments"}],"references":[{"url":"https://wpscan.com/vulnerability/5b481b5f-c994-46b9-9315-008aae77f785/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14222"},{"url":"https://wpscan.com/vulnerability/5b481b5f-c994-46b9-9315-008aae77f785"},{"url":"https://github.com/advisories/GHSA-hc6v-wvgv-hh32"}],"sources":{"cve":[{"id":"CVE-2026-14222","title":"Easy Appointments \u003c 3.12.28 - Contributor+ Connection Deletion via Missing Authorization","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.","status":"published","published":"2026-07-30T06:00:05.605Z","modified":"2026-08-10T12:33:34.97Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-50983","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.","status":"published","published":"2026-07-30T06:00:05Z","modified":"2026-08-10T12:33:34Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-hc6v-wvgv-hh32","title":"The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce...","description":"The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T21:32:51Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:09:59.177116Z"}],"nvd":[{"id":"CVE-2026-14222","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.","status":"published","published":"2026-07-30T06:24:59.907Z","modified":"2026-08-10T13:17:57.297Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}