CVE-2026-8789

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 3.12.28

Description The plugin is susceptible to unauthorized data modification because it fails to perform capability checks and nonce verification on the ea delete multiple connections AJAX action. A nonce is a unique token used to protect against cross-site request forgery. This flaw allows authenticated users with Contributor-level permissions or higher to delete arbitrary connection records from the wp ea connections table, which disrupts the core booking functionality.

Recommendations Update the plugin to version 3.12.28 or later.