CVE-2026-14222 — Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing Authorization
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-l…
Published: 2026-07-30 · CVSS: 3.8 · CVSS 3.1
The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7