Easy!Appointments 1.5.2 and earlier contain a flaw where CSRF verification is only applied to POST requests, while several endpoints that alter state accept parameters from GET or $_REQUEST. The flaw allows an attacker to craft GET requests that are processed as state‑changing actions, enabling the creation of new admin accounts, modification of admin credentials, and full takeover of administrative sessions. This deficiency maps to CWE‑352, a missing or improper protection against Cross‑Site Request Forgery.

The product affected is Easy!Appointments (easy!appointments) version 1.5.2 and all earlier releases. The vulnerability resides in the core file EA_Security.php, where CSRF checks are skipped for non‑POST methods.

The CVSS score is 7.4, indicating a high severity for privilege escalation. The EPSS score is listed as <1%, implying a low current exploitation probability, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is a web‑browser CSRF, where a malicious site or email links a victim to a crafted GET request targeting the vulnerable endpoint. Once a victim's authenticated session is used to visit the URL, the state‑changing operation executes without a CSRF token, granting the attacker administrative privileges. The impact is limited to the affected Easy!Appointments instance, but the consequences are significant due to full admin takeover.