The Easy Appointments plugin for WordPress suffers from an authorization bypass caused by the absence of a proper permission check before performing appointment cancellations. This flaw, classified as CWE‑862, allows any authenticated user with the author role or higher to retrieve a nonce printed on the appointments admin page and then issue a bulk cancellation request that marks all future appointments as abandoned. The result is a total loss of appointment integrity and potential disruption of the service offered by the site.

Appointments version 3.12.27 or earlier. Any site running the plugin within this version range is impacted, regardless of the number of appointments stored.

The CVSS score of 4.3 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation; the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is that an attacker gains web access to the site and authenticates with an author or higher account, visits the appointments admin page to obtain the nonce, and then submits the bulk cancellation request. No elevated privileges beyond the author role are required for the attack, making it relatively easy for low‑privileged users to exploit the flaw.