# CVE-2026-14221: Easy Appointments WordPress plugin missing authorization in appointment management

Source: https://junglewise.ai/threats/cve-2026-14221-easy-appointments-wordpress-plugin-missing-authorization-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-14221 · Severity: info · CVSS 3.8 · Published 2026-07-30

The Easy Appointments plugin for WordPress, which manages booking and scheduling, contains a security flaw that allows users with low-level 'Contributor' access to view and modify customer data. An attacker could exploit this to read private appointment details (including names and contact information), delete existing bookings, or create fraudulent appointments. This could lead to significant data privacy breaches and operational disruption for businesses relying on the plugin for scheduling.

Technologies: [Easy Appointments](https://junglewise.ai/threats/technologies/easy-appointments). Vendors: [Easy Appointments](https://junglewise.ai/threats/vendors/easy-appointments).

## Quick answers

**Is CVE-2026-14221 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-14221 being exploited in the wild.

**How severe is CVE-2026-14221?** Informational severity, with a CVSS score of 3.8, published 30 July 2026.

**Which products and versions are affected?** Easy Appointments <= 3.12.26.

**Is there a fix for CVE-2026-14221?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-14221 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-14221?** Check whether you run Easy Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Easy Appointments plugin for WordPress (up to and including version 3.12.26) is vulnerable to an authorization bypass due to missing capability checks in several AJAX actions (e.g., ea_appointments, ea_appointment). While the plugin uses nonces for CSRF protection, these nonces are accessible to any authenticated user with 'edit_posts' permissions (Contributor level). An attacker with such access can bypass intended restrictions to perform CRUD operations on appointment data via admin-ajax.php. This allows for the disclosure of sensitive customer PII (names, emails, phone numbers) and the unauthorized modification or deletion of booking records. As of the advisory date, no patch has been confirmed.

## Affected products

- Easy Appointments Easy Appointments <= 3.12.26

## Timeline

- 2026-07-01: other: Vulnerability added to WPScan database
- 2026-07-08: disclosed: Public disclosure
- 2026-07-30: advisory: NVD publication date

## References

- [https://wpscan.com/vulnerability/0ab7d35e-4552-4da0-857e-7fb56e576494/](https://wpscan.com/vulnerability/0ab7d35e-4552-4da0-857e-7fb56e576494/)

## Related threats

- [Easy Appointments plugin appointment cancellation token forgery](https://junglewise.ai/threats/cve-2026-87965-easy-appointments-plugin-appointment-cancellation-token-forgery)
- [Easy Appointments DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-81798-easy-appointments-dom-based-cross-site-scripting)
- [Easy Appointments WordPress plugin information disclosure in REST API](https://junglewise.ai/threats/cve-2026-14226-easy-appointments-wordpress-plugin-information-disclosure-in-rest)
- [Easy Appointments WordPress plugin IDOR in customer details retrieval](https://junglewise.ai/threats/cve-2026-14223-easy-appointments-wordpress-plugin-idor-in-customer-details)
- [Easy Appointments WordPress plugin unauthorized connection deletion](https://junglewise.ai/threats/cve-2026-14222-easy-appointments-wordpress-plugin-unauthorized-connection)