The Easy Appointments WordPress plugin prior to version 4.0.2.2 authorizes the cancellation and confirmation of appointments through an email‑link token that is derived from a hard‑coded salt and the appointment’s creation timestamp. Because the token is not random enough, attackers who learn or can guess the timestamp can forge the token, enabling them to cancel or confirm appointments without authentication. This flaw is a classic authorization bypass (CWE‑284) and can be used to disturb the booking schedule, potentially causing service denial or customer dissatisfaction. The likely attack vector is that an adversary sends a user or directly accesses the cancellation/confirmation endpoint with a crafted link containing the forged token and a guessed timestamp. The request requires no login or additional credentials, only the ability to hit the endpoint, and therefore the exploitation process is simple to automate. The CVSS score of 4.8 and an EPSS score of less than 1 % indicate a moderate severity with low probability of large‑scale exploitation. The vulnerability is not included in the CISA KEV catalog. However, because the affected plugin is commonly used for booking systems, any successful manipulation of appointment status can compromise service availability and user trust, making timely remediation a priority.

WordPress sites that have the Easy Appointments plugin installed, versions earlier than 4.0.2.2. Attackers can target any user who receives an email containing the appointment link, or any subscriber who can query the cancellation/confirmation endpoint. The vulnerability does not require code execution; it exploits an improper authorization check in the plugin's email‑link handling logic.

The severity (CVSS 4.8) coupled with a very low EPSS suggests only a modest risk of widespread exploitation. The exploit is straightforward to perform by forging a known timestamp and submitting the resulting URL to the plugin’s endpoint. The absence from KEV reduces concern for existing known attacks, but the potential for denial of service and customer loss warrants moderate concern for organizations that rely heavily on the plugin’s booking function.