{"id":"CVE-2026-8789","aliases":["EUVD-2026-48600","GHSA-xxw4-4rgm-pwm2"],"status":"published","title":"Easy Appointments \u003c= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion","description":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00401,"percentile":0.3476,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-07-24T14:34:50Z","modified":"2026-07-24T20:45:45Z","products":[{"vendor":"easyappointments","product":"easy appointments"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47ed52b3-4bfe-46ce-aabc-7a4647ab7db5?source=cve"},{"url":"https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3595856%40easy-appointments\u0026new=3595856%40easy-appointments"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8789"},{"url":"https://github.com/advisories/GHSA-xxw4-4rgm-pwm2"}],"sources":{"cve":[{"id":"CVE-2026-8789","title":"Easy Appointments \u003c= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection Deletion","description":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.","status":"published","published":"2026-07-24T14:34:50.754Z","modified":"2026-07-24T15:31:56.28Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-48600","description":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.","status":"published","published":"2026-07-24T14:34:50Z","modified":"2026-07-24T15:31:56Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:19:39.725566Z"}],"ghsa":[{"id":"GHSA-xxw4-4rgm-pwm2","title":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due...","description":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.","status":"published","published":"2026-07-24T15:33:03Z","modified":"2026-07-24T15:33:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:09:46.569394Z"}],"nvd":[{"id":"CVE-2026-8789","description":"The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.","status":"published","published":"2026-07-24T15:19:08.32Z","modified":"2026-07-24T20:45:45.697Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:12:32.473901Z"}]}}