PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39513 Easy Appointments CVE debrief

CVE-2026-39513 is a HIGH severity vulnerability (CVSS Score: 7.5) in Easy Appointments plugin versions <= 3.12.21. The vulnerability is caused by unauthenticated broken access control. The CVE was published on 2026-06-15T21:16:45.970Z and last modified on 2026-06-15T21:24:32.790Z.

Vendor
Easy Appointments
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of Easy Appointments plugin versions <= 3.12.21 should apply patches or mitigations to prevent exploitation.

Technical summary

The vulnerability has a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N and is classified under CWE-862.

Defensive priority

HIGH

Recommended defensive actions

  • Apply patches or updates to Easy Appointments plugin versions <= 3.12.21.
  • Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-21-broken-access-control-vulnerability?_s_id=cve) for mitigation or vendor advice.

Evidence notes

The CVE record is sourced from [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-39513) and NVD details can be found at [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-39513).

Official resources

CVE-2026-39513 was published on 2026-06-15T21:16:45.970Z and last modified on 2026-06-15T21:24:32.790Z.