Unauthenticated Booking System Deletion in Easy Appointments Plugin

Executive Summary

This vulnerability affects the Easy Appointments WordPress plugin up to version 3.12.26. It involves a missing authorization check in the connection-deletion functionality, allowing users with Contributor-level access to delete booking configurations and disable the booking system. The issue occurs because the plugin does not verify capabilities or nonces in the ea_delete_multiple_connections action.

Useful 0 Not Useful 0

Detection Guidance

Check if the Easy Appointments plugin version is 3.12.26 or lower. Look for unauthorized deletion of booking configurations by users with Contributor-level access. Monitor for POST requests targeting the ea_delete_multiple_connections action without proper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Contributor access can exploit this by sending a crafted POST request via the browser console or through a CSRF attack. This would delete all connections and break the front-end booking form, disabling the booking system entirely.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to delete booking configurations. For GDPR, unauthorized deletion of appointment data may violate data integrity and access control requirements. For HIPAA, it could compromise the availability of protected health information if booking systems are disabled.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Easy Appointments plugin to the latest version if available. Restrict Contributor-level access to only trusted users. Implement additional security measures like nonce verification and capability checks for sensitive actions.

Useful 0 Not Useful 0