CVE-2026-11992— Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
Possible ATT&CK Techniques 1AI
T1136.001 · Local AccountAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| easyappointments | Easy Appointments | ≤ 3.12.27 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-11992
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to cancel all upcoming appointments site-wide by marking every future appointment stored by the plugin as abandoned. The nonce required to authenticate the cancellation request is printed on the Appointments admin page, which is itself gated only by the edit_posts capability that Authors possess, making the nonce readily accessible to low-privileged users.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Easy Appointments 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Easy Appointments是WordPress基金会的一款CMS插件组件。 WordPress Easy Appointments 3.12.27及之前版本存在授权问题漏洞，该漏洞源于未正确验证用户授权，可能导致经过身份验证的攻击者取消所有即将到来的预约。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| easyappointments | Easy Appointments | 0 ~ 3.12.27 | - |
II. Public POCs for CVE-2026-11992
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11992
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-11992 (1)
Vendor Advisories for CVE-2026-11992 (1)
Other References for CVE-2026-11992 (1)
IV. Related Vulnerabilities
Same product: Easy Appointments
- CVE-2026-61946
WordPress Easy Appointments plugin <= 3.12.27 - Insecure Dir - CVE-2026-39513
WordPress Easy Appointments plugin <= 3.12.21 - Broken Acces - CVE-2026-2262
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Inf - CVE-2025-49398
WordPress Easy Appointments plugin <= 3.12.14 - Content Inje - CVE-2023-30748
WordPress Easy Appointments plugin <= 3.10.7 - Auth. Stored
Same weakness: CWE-862
- CVE-2026-65895
Grav API Plugin before 1.0.10 Broken Access Control - CVE-2026-64814
IntelliJ IDEA远程开发未授权文件访问漏洞 - CVE-2026-65537
WordPress Cyr to Lat reloaded – transliteration of links and - CVE-2026-65531
WordPress Qubely plugin <= 1.8.14 - Broken Access Control vu - CVE-2026-65530
WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Cont
V. Comments for CVE-2026-11992
No comments yet