Executive brief
The Easy Appointments plugin for WordPress, which manages booking and scheduling, contains a security flaw that allows any registered user to view all appointments on the site. This includes sensitive information such as customer names, appointment times, and booking statuses. An attacker with basic account access could use this to harvest private customer data and business schedules.
Technical details
The Easy Appointments plugin fails to implement proper authorization checks on its REST API endpoint for listing appointments (`/wp-json/easy-appointments/v1/appointments`). The endpoint only requires a basic capability held by all authenticated users (Subscriber level and above) rather than administrative privileges. By providing a valid REST nonce, an authenticated attacker can query the endpoint with date parameters to retrieve a full list of bookings. The returned data includes customer names (in the title field), start/end times, statuses, and internal IDs. As of the advisory date, no patch is available.
Affected products
- Unknown Easy Appointments <= 3.12.26
Timeline
- 2026-07-01: other: Vulnerability added to WPScan database
- 2026-07-08: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD advisory published