Blast

**Name of the Vulnerable Software and Affected Versions** Easy Appointments versions 4.0 through 4.0.2.1 **Description** The plugin fails to perform ownership or authorization checks on the unauthenticated appointment-reservation endpoint. This allows unauthenticated attackers to overwrite or delete arbitrary appointments by providing a specific `id` in the request. This issue is an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization. **Recommendations** Update Easy Appointments to version 4.0.2.2 or later.