The Easy Appointments WordPress plugin contains a missing authorization check in several appointment‑management endpoints. The implementation relies only on a nonce that any authenticated user can obtain, allowing a user with contributor privileges to read all customer appointment details and to create, modify, or delete bookings. This weakness falls under CWE‑284, an improper access control flaw that enables an attacker to bypass security restrictions and tamper with sensitive data.

Any WordPress site running Easy Appointments plugin version 4.0 or earlier is affected. Users who possess a contributor role or higher can exploit the lack of capability checks to view or alter appointment information. The vulnerability is present across all installations of the plugin, regardless of additional configuration or the presence of other security plugins.

The CVSS score of 3.8 indicates moderate overall risk, reflecting that the issue requires an authenticated user to exploit. The EPSS score of less than 1% suggests that exploitation is unlikely in the wild, and the vulnerability is not included in the CISA KEV catalog. The likely attack path is a legitimate contributor account; the attacker must be able to log in to the WordPress site, obtain the nonce, and then issue requests to the affected endpoints. Because capabilities are not checked, the attacker can read, create, update, or delete any booking data. The impact is limited to the data stored within the Easy Appointments plugin rather than the broader system, but any damage to scheduling or customer data could cause operational disruptions for the site owner.