Easy Appointments

The Easy Appointments plugin for WordPress, in versions up to and including 3.12.27, is vulnerable to unauthorized data modification due to a missing capability check and nonce verification on the `ea_delete_multiple_connections` AJAX action, allowing authenticated attackers with Contributor-level access or higher to delete arbitrary connection records and disrupt core booking functionality.

The Easy Appointments WordPress plugin through version 3.12.21 exposes sensitive customer appointment data, including names, emails, phone numbers, and IP addresses, due to an improperly secured REST API endpoint.