Easy Appointments CVE-2026-14188

Exploitation requires an authenticated WordPress session with at minimum contributor-level role privileges - a role that permits drafting posts but not publishing or managing users, and is commonly granted on multi-author sites or sites with open registration. The Easy Appointments plugin must be installed and active, and at least one customer record must exist in the database for data to be exposed. The vulnerable handler is invoked over the network with no user interaction from an administrator or victim. Exploitation is limited by the need for a valid authenticated session; unauthenticated visitors cannot trigger the flaw. Sites that restrict WordPress registration or have no contributor-role accounts reduce exposure significantly.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) scores 2.7 and labels the required privilege as High (PR:H), which is inconsistent with the description - contributor is a low-privilege WordPress role, not an administrator. This discrepancy inflates the apparent difficulty for an attacker; the realistic exploitation bar is closer to PR:L, which would yield a score around 4.3. EPSS at 0.16% (5th percentile) indicates low automated exploitation activity. A public exploit (WPScan PoC) exists, which could enable opportunistic mass scanning across WordPress installations. The impact is scoped strictly to confidentiality of customer records (C:L); no integrity or availability impact is present. Real-world risk is moderate for any site with customer-facing appointment data: the attacker needs only a contributor account, obtainable via open registration or a compromised low-privilege account.

An attacker registers or compromises a contributor account on a target WordPress site running Easy Appointments ≤ 3.12.26. Using the publicly available WPScan proof-of-concept, they send an authenticated HTTP request directly to the unprotected customer-listing handler, bypassing the absent capability and nonce checks, and receive a full dump of stored customer personal information including names and contact details.