The Easy Appointments plugin for WordPress versions up to 3.12.27 contains an unauthenticated Insecure Direct Object Reference vulnerability. By manipulating object identifiers exposed in the plugin’s URLs or request parameters, an attacker can read or modify appointment data that should be protected, leading to disclosure or tampering of scheduling information. The weakness is a classic example of CWE‑639, where insufficient access control allows an unauthenticated user to influence operations that affect the integrity of the system.

Any WordPress installation that has the Easy Appointments plugin version 3.12.27 or older deployed. The vulnerability applies to all environments using the affected plugin regardless of user role, because authentication is not required to exploit the IDOR.

The CVSS score of 6.5 places the issue in the Medium severity category. The EPSS score of < 1% indicates a very low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the typical behavior of IDOR vulnerabilities in WordPress plugins, it is inferred that the attack vector is remote through the web interface; however, the CVE description does not explicitly state the attack path, so this inference is marked as such. The overall risk remains moderate but should be addressed promptly to prevent potential data theft or manipulation.