Easy Appointments Unauthenticated IDOR (CVE-2026-61946)

Public reservation endpoint accepted client-supplied appointment id and overwrote victim bookings; fixed in Easy Appointments 3.12.28; PoC on Sploitus.

Summary

CVE-2026-61946 is an unauthenticated insecure direct object reference in the WordPress Easy Appointments plugin (easy-appointments). The public reservation action (ea_res_appointment) accepted an appointment id from the query string and passed it into the plugin’s database replace() path, turning a “create booking” request into an update of an existing row. No WordPress login required.

Affected: 3.12.27 and earlier. Fixed: 3.12.28. Reported via Patchstack (2026-04-03); Patchstack entry 2026-07-16; CVE published 2026-07-23. Researcher: Daniel Wade. PoC indexed on Sploitus.

Technical Details

Aspect	Detail
CVE	CVE-2026-61946
Plugin	Easy Appointments
Vector	Unauthenticated public reservation AJAX/action
Bug	Client-controlled primary key → `models->replace('ea_appointments', …)`
Fix idea	Strip / null `id` on public create path so replace cannot target existing rows

Nonce/CAPTCHA did not establish ownership of the supplied ID; on default configs they may be disabled, so no session state was required. Availability checks still applied — attackers needed a valid open slot, location, service, and worker.

Impact

Overwrite of another customer’s appointment (PII swap, denial of service against bookings, social-engineering pivots). Lower severity than RCE but high integrity impact for scheduling businesses.

Mitigation

Update Easy Appointments to ≥ 3.12.28.
Enable nonce/CAPTCHA as defense-in-depth (not a substitute for the IDOR fix).
Monitor reservation endpoints for requests carrying unexpected id parameters.
Review Patchstack advisory for additional hardening notes.

Sources

→ Source