CVE-2026-14226

Deferred Deferred - Pending Action

Unauthorized Access to Booking Data in Easy Appointments Plugin

Publication date: 2026-07-30

Last updated on: 2026-08-10

Assigner: WPScan

Description

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-10

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-14226

EUVD

EUVD-2026-50985

Affected Vendors & Products

Vendor	Product	Version / Range
easy_appointments	easy_appointments	3.12.26
easy_appointments	easy_appointments	to 3.12.26 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is a sensitive information disclosure flaw in the Easy Appointments WordPress plugin up to version 3.12.26. It allows users with subscriber-level access to read all bookings on the site through a REST endpoint, including customer names, schedules, and statuses. The plugin does not properly restrict access to the appointments-listing endpoint, letting any authenticated user retrieve full calendar data.

Detection Guidance

Check if unauthenticated or low-privilege users can access the REST endpoint /wp-json/easyappointments/v1/appointments. Use a subscriber account to attempt accessing this endpoint via curl or browser and verify if appointment data is returned.

Impact Analysis

If you use the Easy Appointments plugin, attackers with subscriber-level access could exploit this to view all appointments, exposing sensitive customer data like names, schedules, and booking statuses. This could lead to privacy violations, reputational damage, or further targeted attacks using the exposed information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA by exposing personal and sensitive health-related data without proper access controls. GDPR requires strict protection of personal data, while HIPAA mandates safeguards for protected health information. Unauthorized access to such data could result in legal penalties and compliance failures.

Mitigation Strategies

Update the Easy Appointments plugin to the latest version beyond 3.12.26. If an update is unavailable, restrict access to the vulnerable REST endpoint via server rules or disable the plugin until a patch is applied.

Hi! I’m here to help you understand CVE-2026-14226. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70