CVE-2026-87965 describes an improper access control vulnerability (CWE-284) in the Easy Appointments WordPress plugin versions prior to 4.0.2.2. The plugin's authorization mechanism for mail-link appointment cancellation and confirmation relies on a token generated from a hardcoded salt and the appointment's creation timestamp. Because the token is predictable, unauthenticated attackers who know or can guess the timestamp can generate valid tokens to cancel or confirm appointments without authorization.

An attacker can cancel or confirm arbitrary appointments without authentication by exploiting the predictable token generation. This could disrupt appointment scheduling and potentially cause denial of service or unauthorized appointment modifications.

Upgrade Easy Appointments to version 4.0.2.2 or later, where this vulnerability is fixed. The vendor advisory indicates that versions before 4.0.2.2 are affected, so applying the official update is the recommended remediation.