Easy Appointments CVE-2026-14221

Exploitation requires the attacker to hold at minimum a contributor-level account on the target WordPress site (PR:L); unauthenticated visitors cannot exploit this flaw. The Easy Appointments plugin must be installed and active. The sole technical prerequisite is obtaining a valid WordPress nonce, which is automatically available to any logged-in user from standard page loads. Exploitation is limited by the requirement for prior authentication - sites that disable open registration or require admin approval for new accounts reduce the attack surface significantly. No special plugin configuration or non-default settings are required; the flaw exists in the default installation. The impact is bounded to confidentiality of appointment data and integrity of booking records; no system-level access or availability impact applies.

The NVD-assigned CVSS score of 3.8 with PR:H significantly underrepresents real-world risk. The description explicitly identifies the actor as 'contributor-level,' which is a low-privilege WordPress role (not an administrator or editor), making PR:H inconsistent with actual exploitation requirements - this discrepancy should be verified with the vendor but assessed PR:L is more accurate. The EPSS score of 0.15% at the 5th percentile indicates low probability of broad automated exploitation, which is typical for WordPress plugin flaws requiring authenticated access. However, a publicly available exploit exists (no KEV listing), meaning the barrier to exploitation is low for any attacker who can register or compromise a contributor account. Sites permitting open user registration are at materially higher risk. The combined impact - unauthorized access to customer PII plus the ability to disrupt appointment operations - is meaningful for healthcare, legal, and service-industry sites relying on the plugin, despite the low CVSS score.

An attacker registers or compromises a contributor account on a target WordPress site running Easy Appointments. After logging in, they retrieve a valid nonce from any authenticated page in their session, then craft direct AJAX POST requests to the plugin's appointment-management actions using that nonce. Because no capability check is performed, the plugin processes the requests as if they came from an administrator, exposing all customer names, contact details, and appointment records, and allowing the attacker to create fraudulent bookings or cancel legitimate ones. A publicly available exploit simplifies this process.