Executive brief
The Easy Appointments WordPress plugin allows authenticated users with contributor-level access or higher to extract sensitive customer data from the application, including names, email addresses, phone numbers, dates of birth, and physical addresses. An attacker with the required account privileges can access this private information through the plugin's AJAX interface without additional restrictions, potentially exposing the personal details of all customers in the database.
Technical details
The handle_customers_ajax function in the Easy Appointments plugin fails to properly restrict data access for authenticated users, allowing those with contributor-level permissions or above to retrieve the full ea_customers table without additional authorization checks. The vulnerability is exploitable via the plugin's AJAX interface and requires an authenticated account with at least contributor-level access. Successful exploitation exposes personally identifiable information stored in the customer dataset.
Affected products
- WordPress Easy Appointments up to 3.12.27
Timeline
- 2026-09-19: disclosed