The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the ea_delete_multiple_connections AJAX action in all versions up to, and including, 3.12.27. This allows authenticated attackers with Contributor-level access or higher to delete arbitrary connection records from the wp_ea_connections table, disrupting the plugin’s core booking functionality. The weakness is a missing authorization control (CWE‑863).

Affected systems are installations of the Easy Appointments WordPress plugin version 3.12.27 or earlier. WordPress sites running these plugin versions are vulnerable regardless of other plugins or themes.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1%, suggesting the probability of exploitation is very low at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires web access to the site and a logged‑in user with Contributor or higher role. The attacker can perform an AJAX request to the ea_delete_multiple_connections endpoint to remove any specified connection record.