Information Disclosure in Easy Appointments WordPress Plugin

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the Easy Appointments WordPress plugin up to version 3.12.26. It allows users with subscriber-level access to read other customers' personal information by exploiting missing ownership or capability checks when retrieving customer details.

Useful 0 Not Useful 0

Detection Guidance

Check if the Easy Appointments plugin version is 3.12.26 or lower. Look for unauthorized access to customer PII by monitoring requests to admin-ajax.php with subscriber-level credentials. Enable logging for the 'Customer Search' feature if it is active.

Useful 0 Not Useful 0

Impact Analysis

If you have a subscriber account on a vulnerable site, an attacker could access your personal data. If you run such a site, attackers could steal customer PII including foreign data if the Customer Search feature is enabled. The attack involves scraping a nonce and sending crafted requests to admin-ajax.php.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personally identifiable information. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A breach could lead to legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the 'Customer Search' feature in the plugin settings. Remove or restrict subscriber-level access if not required. Monitor network traffic for suspicious requests to admin-ajax.php. Consider temporarily disabling the plugin until an official patch is released.

Useful 0 Not Useful 0