Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

CVE-2026-14226

The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14223

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14221

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-14188

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14222

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14226 Easy Appointments <= 3.12.26 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14226

The Easy Appointments WordPress plugin (up to version 3.12.26) exposes an appointment-listing REST endpoint that does not enforce a sufficient capability, restricting access to a capability held by all authenticated users. This allows subscriber-level users to read all bookings on the site, inclu...

EUVD-2026-50983

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222 Easy Appointments <= 3.12.26 - Contributor+ Connection Deletion via Missing Authorization

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

EUVD-2026-50984

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14221 Easy Appointments <= 3.12.26 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-14222

The CVE covers Easy Appointments for WordPress up to version 3.12.26, where one of the connection-deletion actions does not enforce capability or nonce checks. This lack of authorization allows users with contributor-level access to delete the booking configuration and disable the booking system....

CVE-2026-14223 Easy Appointments <= 3.12.26 - Subscriber+ Customer PII Disclosure via IDOR

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14188 Easy Appointments <= 3.12.26 - Contributor+ Customer Data Disclosure

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14221

The CVE-2026-14221 affects the Easy Appointments WordPress plugin up to version 3.12.26. The vulnerability arises because the plugin does not perform capability checks on several appointment-management actions and relies on a nonce that is obtainable by any authenticated user. This permits users ...

CVE-2026-14188

The CVE-2026-14188 details a vulnerability in the Easy Appointments WordPress plugin (versions up to 3.12.26) where a customer-listing handler does not perform a per-request capability check or nonce verification. This allows authenticated users with contributor-level access to read every stored ...

CVE-2026-52841

creationtimestamp| type| source ---|---|--- 2026-07-29 18:35:16+00:00| published-proof-of-concept| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr 2026-07-30 03:31:37+00:00| seen| https://gist.github.com/alon710/555463e864b3e92acb0ee1bba5502d4f...

EUVD-2026-43723

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...

CVE-2026-14224

The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A...