CVE-2026-8789
Received Received - Intake

Unauthorized Data Deletion in Easy Appointments WordPress Plugin

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: Wordfence

Description
The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-8789
EUVD
EUVD-2026-48600

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
easy_appointments easy_appointments to 3.12.27 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Easy Appointments WordPress plugin has a vulnerability due to missing capability checks and nonce verification on the ea_delete_multiple_connections AJAX action. This allows authenticated attackers with Contributor-level access or higher to delete arbitrary connection records from the wp_ea_connections table, disrupting the plugin's booking functionality.

Detection Guidance

Check WordPress sites running Easy Appointments versions up to 3.12.27 for unauthorized deletions in the wp_ea_connections table. Review server logs for AJAX requests to ea_delete_multiple_connections with Contributor-level or higher access.

Impact Analysis

If exploited, this vulnerability could allow attackers to delete important connection records, breaking the plugin's ability to manage bookings. This could disrupt scheduling, cause data loss, and affect the availability of appointment services.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, potentially violating GDPR's integrity principle or HIPAA's availability requirements. Loss of booking data may result in non-compliance with data protection regulations.

Mitigation Strategies
  • Update Easy Appointments plugin to the latest version beyond 3.12.27.
  • Restrict Contributor-level and higher user roles to prevent unauthorized access.
  • Monitor wp_ea_connections table for unexpected deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8789. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart