CVE-2024-2844: Easy-Appointments Easy Appointments

Medium severity, CVSS 4.3. EPSS: 0.4% chance of exploitation in the next 30 days.

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to insufficient user validation on the ajax_cancel_appointment() function in all versions up to, and including, 3.11.18. This makes it possible for unauthenticated attackers to cancel other users orders.

Affected products

• Easy-Appointments Easy Appointments: before 3.11.19 (fixed in 3.11.19)

Published 2024-03-29. Last modified 2026-06-17.