CVE-2026-14223

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14188

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

EUVD-2026-50983

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14222: Improper Access Control

The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

CVE-2026-14226: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site,...

CVE-2026-14223: Authorization Bypass Through User-Controlled Key

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

PT-2026-66382

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

PT-2026-66383

Name of the Vulnerable Software and Affected Versions Easy Appointments WordPress plugin versions prior to 3.12.28 Description An insufficient capability check on an appointment-listing REST endpoint allows users with subscriber-level access to read all bookings on the site. This includes access ...

CVE-2026-14221: Improper Access Control

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

CVE-2026-14188: Exposure of Sensitive Information to an Unauthorized Actor

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

PT-2026-66380

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

PT-2026-66381

The Easy Appointments WordPress plugin through 3.12.26 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system...

PT-2026-66378

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information...

CVE-2026-52841

creationtimestamp| type| source ---|---|--- 2026-07-29 18:35:16+00:00| published-proof-of-concept| https://github.com/alextselegidis/easyappointments/security/advisories/GHSA-8hm4-r66f-29wr 2026-07-30 03:31:37+00:00| seen| https://gist.github.com/alon710/555463e864b3e92acb0ee1bba5502d4f...

EUVD-2026-43723

Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync...

GHSA-XGR6-PQJV-3PF8 Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

Summary The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the...

Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page

Summary The booking reschedule view at /index.php/booking/reschedule/appointmenthash handled by Booking::index embeds the entire customer record as inline JavaScript const vars = ... "customerdata": ..., ... without authentication and without field whitelisting. Anyone in possession of the...

CVE-2026-14224

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-lev...

CVE-2026-14224

The Easy Appointments WordPress plugin versions prior to 3.12.28 is vulnerable to an IDOR (Insecure Direct Object Reference) flaw. The plugin fails to verify that the appointment targeted by its customer-data update action belongs to the authenticated user, relying instead on a shared nonce that ...

WordPress Easy Appointments plugin <= 3.12.26 - Subscriber+ Cross-User Appointment Data Modification vulnerability

Subscriber+ Cross-User Appointment Data Modification vulnerability discovered by Duy Tran in WordPress Plugin Easy Appointments versions = 3.12.26...