Compliance Impact

The vulnerability allows unauthenticated attackers to access sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information. Exposure of such personal and sensitive data can lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require protection of personally identifiable information and sensitive health or appointment data.

Specifically, under GDPR, unauthorized disclosure of personal data can result in violations related to data confidentiality and integrity, potentially leading to fines and legal consequences. Similarly, HIPAA mandates safeguards to protect patient information, and exposure of appointment details and personal identifiers could constitute a breach.

Useful 0 Not Useful 0

Executive Summary

The Easy Appointments plugin for WordPress has a vulnerability in all versions up to and including 3.12.21. This vulnerability exists in the REST API endpoint `/wp-json/wp/v2/eablocks/ea_appointments/` because it is registered with a permission callback that always returns true, meaning no authentication or authorization is required to access it.

As a result, unauthenticated attackers can access this endpoint and extract sensitive customer appointment data such as full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive customer information. Attackers can obtain personal details including names, contact information, IP addresses, appointment details, and pricing data without any authentication.

Such exposure can result in privacy violations, loss of customer trust, potential identity theft, and could harm the reputation of the affected organization.

Useful 0 Not Useful 0