CVE-2024-2844 describes a missing authorization vulnerability in the Easy Appointments WordPress plugin affecting all versions up to 3.11.18. The ajax_cancel_appointment() function does not properly validate user permissions, allowing unauthenticated attackers to cancel appointments belonging to other users. This vulnerability impacts data integrity by permitting unauthorized modification of appointment data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

An attacker can cancel appointments of other users without authentication, leading to unauthorized modification of appointment data. This compromises the integrity of the scheduling system but does not affect confidentiality or availability according to the CVSS metrics. There are no known exploits in the wild reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the ajax_cancel_appointment() endpoint or implementing additional authorization checks via custom code or security plugins to prevent unauthorized cancellations.