Insufficient Authorization in Easy Appointments Plugin for WordPress
CVE-2026-87965
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 18 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-87965?
The Easy Appointments WordPress plugin prior to version 4.0.2.2 is vulnerable due to the lack of an unguessable token for authorizing mail-link actions related to appointment cancellation and confirmation. The token is derived from a hardcoded salt and the appointment's creation timestamp, which could be known or guessed by unauthenticated attackers. This flaw enables malicious individuals to manipulate appointment statuses without proper authorization, leading to potential service disruption and unauthorized access.
Affected Version(s)
Easy Appointments 0 < 4.0.2.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.