Executive brief
The Easy Appointments plugin for WordPress, which manages booking and scheduling, contains a security flaw that allows users with low-level 'Contributor' access to view and modify customer data. An attacker could exploit this to read private appointment details (including names and contact information), delete existing bookings, or create fraudulent appointments. This could lead to significant data privacy breaches and operational disruption for businesses relying on the plugin for scheduling.
Technical details
The Easy Appointments plugin for WordPress (up to and including version 3.12.26) is vulnerable to an authorization bypass due to missing capability checks in several AJAX actions (e.g., ea_appointments, ea_appointment). While the plugin uses nonces for CSRF protection, these nonces are accessible to any authenticated user with 'edit_posts' permissions (Contributor level). An attacker with such access can bypass intended restrictions to perform CRUD operations on appointment data via admin-ajax.php. This allows for the disclosure of sensitive customer PII (names, emails, phone numbers) and the unauthorized modification or deletion of booking records. As of the advisory date, no patch has been confirmed.
Affected products
- Easy Appointments Easy Appointments <= 3.12.26
Timeline
- 2026-07-01: other: Vulnerability added to WPScan database
- 2026-07-08: disclosed: Public disclosure
- 2026-07-30: advisory: NVD publication date