CVE-2026-14222 Easy Appointments CVE debrief

Who should care

Users of the Easy Appointments WordPress plugin, especially those with contributor-level access, should be aware of this vulnerability and take necessary precautions. They should verify the version of the plugin and update to 3.12.28 or later if necessary. They should also restrict contributor-level access to sensitive actions and monitor for unusual activity related to booking configuration deletion. Additionally, security teams and vulnerability management teams should review the affected scope and severity of the vulnerability and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system. This vulnerability has a CVSS score of 3.8 and a CVSS severity of LOW. Affected users should verify the version of the plugin and update to 3.12.28 or later if necessary. They should also restrict contributor-level access to sensitive actions and monitor for unusual activity related to booking configuration deletion.

Defensive priority

Low-priority defensive actions are recommended. Users with contributor-level access can delete the booking configuration and disable the booking system.

Recommended defensive actions

• Verify the version of the Easy Appointments WordPress plugin and update to 3.12.28 or later if necessary.
• Restrict contributor-level access to sensitive actions.
• Monitor for unusual activity related to booking configuration deletion.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The evidence for this CVE is limited; verify with primary official records such as the CVE record and NVD entry. Further verification is needed to determine the full scope of the vulnerability. Defenders should verify the version of the Easy Appointments WordPress plugin and update to 3.12.28 or later if necessary. They should also restrict contributor-level access to sensitive actions and monitor for unusual activity related to booking configuration deletion.

Official resources