PT-2026-103179

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

PT-2026-103049

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssa locale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

CVE-2026-94673: Authorization Bypass Through User-Controlled Key

Unauthenticated Insecure Direct Object References IDOR in Simply Schedule Appointments = 1.6.12.31 versions...

CVE-2026-94074: Missing Authorization

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

PT-2026-103162

Unauthenticated Broken Access Control in Simply Schedule Appointments = 1.6.12.29 versions...

CVE-2026-89294: Improper Control of Filename for Include/Require Statement in PHP Program

The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27 via the 'ssalocale' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to include and execute...

WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Mor Golan in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.29...

WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by rpgsec in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.31...

CVE-2026-9232

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-9232 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-9232 Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

EUVD-2026-83547

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

CVE-2026-9232

CVE-2026-9232 affects the Easy Appointments plugin for WordPress in all versions up to and including 3.12.27 . A missing authorization check in the handle_customers_ajax (a.k.a. ea_get_customers_ajax) AJAX action allows any authenticated user with contributor-level or higher privileges to extract...

CVE-2026-9232: Missing Authorization

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset...

PT-2026-95795

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 3.12.28 Description The plugin is subject to sensitive information exposure through the handle customers ajax function. Authenticated attackers with contributor-level access or higher can extract the complet...

WordPress Easy Appointments plugin <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure vulnerability

Missing Authorization to Authenticated Contributor+ Sensitive Customer Information Exposure vulnerability discovered by Ryoma Nishioka in WordPress Plugin Easy Appointments versions = 3.12.27...

CVE-2026-89007

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...

CVE-2026-87966

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and...

CVE-2026-87965

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who...

EUVD-2026-82680

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...