Executive brief
The Easy Appointments plugin for WordPress, which manages customer bookings and schedules, contains a security flaw that allows registered users to view other customers' private information. By exploiting this issue, a user with basic account access can download sensitive details such as full names, email addresses, phone numbers, and home addresses of any customer in the system. This could lead to significant privacy violations and the exposure of personal data for all individuals who have booked appointments through the site.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Easy Appointments plugin for WordPress through version 3.12.26. The 'ea_get_customer_detail' AJAX action fails to perform adequate authorization checks or ownership verification when retrieving customer records. An attacker with Subscriber-level privileges can obtain a valid nonce from the front-end booking page and then iterate through the 'id' parameter to retrieve full Personally Identifiable Information (PII) for any customer, including name, email, phone number, and address. This vulnerability requires the 'Customer Search' setting to be enabled and the presence of the [ea_bootstrap] shortcode on a page.
Affected products
- Unknown Easy Appointments <= 3.12.26
Timeline
- 2026-07-01: other: Vulnerability added to WPScan database
- 2026-07-08: disclosed: Public disclosure by WPScan
- 2026-07-30: advisory: NVD publication date