CVE-2026-14222

LowCVSS 3.8

Published: 30/07/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks capability and nonce checks in a connection-deletion action, allowing contributor-level users to delete booking configuration and disable the booking system.

Risk Assessment

A low-privileged user can disrupt the booking system, potentially leading to loss of service availability.

Recommendation

Update the Easy Appointments plugin to version 3.12.28 or later.

Original NVD description (English source)

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system.