CVE-2026-8789

HighCVSS 8.1/10Last modified Jul 24, 2026

Description

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to, and including, 3.12.27. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete arbitrary connection records from the `wp_ea_connections` table, disrupting the plugin's core booking functionality.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 24, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-878905.3An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django CVE-2026-878916.5The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday sc CVE-2026-878925.3The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own se CVE-2026-878945.3The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's CVE-2026-878965.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking age CVE-2026-878989.4OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-878999.4Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.CVE-2026-87906.1The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `shouttext` POST parameter of the Shoutbox wi CVE-2026-879009.4Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a CVE-2026-879018.3Improper sanitization in the registration module allows reflected Cross-Site Scripting.CVE-2026-879028.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the CVE-2026-879075.3The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking ser