Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

CVE-2022-0482_exploit

CVE-2022-0482 脆弱性の悪用 はじめに このドキュメントでは、Easy!Appointments スケジューリングソフトウェアで特定された重大なセキュリティ脆弱性である CVE-2022-0482 の詳細な分析について概説します。CWE-863 に分類される不適切な認可に関連するこの欠陥により、適切な認証なしに個人を特定できる情報への不正アクセスが可能になり、データの機密性と整合性に重大なリスクをもたらします。 著者 Mija Pilkaite 脆弱性の概要 CVE-2022-0482 は、1.4.3 より前のバージョンの Easy!Appointments...

CVE-2026-61946-Easy-Appointments-IDOR

CVE-2026-61946: 1つの予約IDで他人の予約を上書き 私は、WordPressプラグインEasy Appointmentsに、認証なしの安全でないダイレクトオブジェクト参照（IDOR）を発見しました。公開予約エンドポイントはクエリ文字列からidを受け入れ、その結果のデータをプラグインのデータベースreplaceパスに渡していました。...

CVE-2025-29448

CVE-2025-29448 Beschreibung Ein Fehler in der Buchungslogik in Easy!Appointments v1.5.1 ermöglicht es nicht authentifizierten Angreifern, Termine mit übermäßig langer Dauer zu erstellen, was zu einem Denial-of-Service führt, da alle zukünftigen Buchungsmöglichkeiten blockiert werden. Schritte zur...

exploit-CVE-2022-0482

Divulgazione di PII in Easy!Appointments Easy!Appointments --debug exploit.rb -h | --help Options: Root URL base path including HTTP scheme, port and root folder All events since default: 2015-01-11 All events until default: today --debug Display arguments -h, --help Show this screen Examples:...

CVE-2025-50383

CVE-2025-50383 Descrizione Un utente autenticato con privilegi ridotti può sfruttare questa vulnerabilità inviando una richiesta HTTP POST appositamente modificata con un parametro orderby malevolo ad esempio, orderby=IF1=1,SLEEP5,1. Ciò può innescare un attacco SQL injection cieco basato sul...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-62288

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

CVE-2026-19406

The Easy Appointments WordPress plugin before 4.0.1 exposes an appointment-listing REST endpoint without per-user scoping, letting contributor-level accounts read all site bookings including customer names, schedules, and statuses. Fix is to upgrade to version 4.0.1 or later. No in-the-wild explo...

CVE-2026-19406 Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses...

EUVD-2026-54187

The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to...

CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14225

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14225 Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist Bypass

The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execu...

CVE-2026-14226

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14223

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14221

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

CVE-2026-14188

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-14222

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...