CVE-2026-8789 is an authorization vulnerability in the Easy Appointments WordPress plugin affecting all versions up to and including 3.12.27. The vulnerability arises from missing capability checks and nonce verification on the ea_delete_multiple_connections AJAX action, enabling authenticated users with Contributor-level permissions or higher to delete arbitrary records from the wp_ea_connections database table. This unauthorized modification disrupts the core booking functionality of the plugin. The CVSS 3.1 base score is 8.1, reflecting high severity with network attack vector, low attack complexity, privileges required at the low level, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

Authenticated attackers with Contributor-level or higher privileges can delete arbitrary connection records from the plugin's database table, causing disruption to the booking functionality. This results in high integrity and availability impact on the affected system. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to connection record deletions. Implement custom capability checks or nonce verification if possible as a temporary mitigation.