Armx64

**Name of the Vulnerable Software and Affected Versions** Easy Appointments versions prior to 3.12.28 **Description** An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with author-level access or higher can cancel all upcoming site-wide appointments by marking future appointments as abandoned. This is possible because the nonce (a unique token used to prevent cross-site request forgery) required for the cancellation request is displayed on the Appointments admin page, which is accessible to users with the `edit posts` capability. **Recommendations** Update Easy Appointments to version 3.12.28 or later.