CVE-2026-87965: Easy Appointments WordPress Auth Bypass Flaw

CVE-2026-87965 Overview

CVE-2026-87965 is a broken access control vulnerability [CWE-284] in the Easy Appointments WordPress plugin versions prior to 4.0.2.2. The plugin generates authorization tokens for mail-link appointment cancellation and confirmation actions using a predictable algorithm. The token derives from a hardcoded source-embedded salt combined with the appointment's creation timestamp. Unauthenticated attackers who know or guess the creation timestamp can forge valid tokens. This allows them to cancel or confirm arbitrary appointments without authentication.

Critical Impact
Unauthenticated attackers can manipulate arbitrary appointment states by predicting timestamp-derived tokens, disrupting booking workflows and business operations.

Affected Products

Easy Appointments WordPress plugin versions prior to 4.0.2.2

Discovery Timeline

2026-09-18 - CVE-2026-87965 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-87965

Vulnerability Analysis

The Easy Appointments plugin issues email links that allow recipients to cancel or confirm appointments without logging in. These links rely on a token intended to authorize the action. The token generation algorithm combines a static salt embedded in the plugin source code with the appointment's creation timestamp. Because both inputs are either public or discoverable, the resulting token is deterministic and predictable.

An attacker who obtains the plugin source can extract the salt. They then only need the target appointment's creation timestamp to compute a valid cancellation or confirmation token. Timestamps often fall within narrow, guessable windows based on business hours and observed booking cadence.

Root Cause

The root cause is improper use of a security-sensitive value as an authorization credential [CWE-284]. Unguessable, cryptographically random tokens should authorize sensitive state-changing actions. Instead, the plugin derives its token from low-entropy inputs. The hardcoded salt provides no meaningful secrecy once the plugin code is inspected. The creation timestamp provides insufficient entropy for authorization.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker inspects the publicly available plugin source to recover the embedded salt. The attacker then enumerates plausible Unix timestamps within a target window. For each candidate timestamp, the attacker computes the token and issues the corresponding cancellation or confirmation request to the WordPress endpoint. Valid tokens successfully change appointment state on the server.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-87965

Indicators of Compromise

Unexpected appointment status transitions to cancelled or confirmed without corresponding user email interaction logs.
High-volume sequential requests to the plugin's cancellation or confirmation endpoints from a single source address.
Requests containing token parameters that do not correlate with any outbound notification email issued by the site.

Detection Strategies

Correlate outgoing appointment notification emails with inbound token-bearing requests, and alert on inbound requests lacking a matching outbound email.
Monitor web server access logs for enumeration patterns against the plugin's action endpoints, particularly requests iterating through timestamp-adjacent token values.
Review appointment audit records for state changes originating from IP addresses that never rendered the booking page.

Monitoring Recommendations

Enable verbose logging on the Easy Appointments plugin action handlers and forward logs to a centralized store for retention and analysis.
Alert on bursts of 4xx or 2xx responses from the cancellation and confirmation endpoints exceeding baseline traffic.
Track anomalous cancellation rates per business day and trigger review when rates deviate from historical norms.

How to Mitigate CVE-2026-87965

Immediate Actions Required

Update the Easy Appointments WordPress plugin to version 4.0.2.2 or later on all affected sites.
Audit recent appointment state changes for the presence of unauthorized cancellations or confirmations.
Notify affected customers if unauthorized appointment modifications are identified during the audit.

Patch Information

Upgrade to Easy Appointments version 4.0.2.2 or later, which replaces the predictable token algorithm with an unguessable authorization token. Consult the WPScan Vulnerability Report for release details.

Workarounds

Temporarily disable the mail-link cancellation and confirmation feature and require authenticated user actions through the WordPress admin or customer account.
Place the plugin action endpoints behind a web application firewall rule that rate-limits requests per source address.
Restrict access to appointment endpoints by IP allowlisting where the booking audience is known and bounded.

bash

# Example WP-CLI update command
wp plugin update easy-appointments --version=4.0.2.2