The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Easy Appointments Plugin | — | Update easy-appointments plugin to version 4.0.2.2, or a newer patched version | Oct 30, 2026 | Sep 16, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub