Easy Appointments CVE-2026-14223

Exploitation requires a WordPress account with at minimum subscriber-level access (PR:L per CVSS vector). On sites where open user registration is enabled - the WordPress default - any internet user can self-register a subscriber account, making this effectively reachable by unauthenticated internet users who complete a one-time registration step. The Easy Appointments plugin must be installed and active. No specific non-default plugin configuration or feature flag is required; the vulnerable endpoint is present in all installations through 3.12.26. Exploitation is limited on sites where user registration is closed or restricted, as the attacker must already hold a legitimate subscriber account. No special network position (e.g., same network segment) is required - the endpoint is reachable over standard HTTPS.

The CVSS 4.3 Medium score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N accurately characterises the attack surface: network-reachable, low complexity, but gated behind subscriber-level authentication. EPSS at 0.15% (5th percentile) suggests exploitation is not occurring at scale, which is consistent with the absence of a KEV listing. However, the publicly available WPScan exploit significantly reduces the skill barrier, and the real-world risk is highly deployment-dependent: sites with open user registration (WordPress default allows self-signup) are effectively exposed to any internet user who can create an account, while closed-registration sites face risk only from already-trusted users. The raw CVSS confidentiality impact of 'Low' may understate regulatory exposure - customer PII scraped in bulk across all bookings can trigger GDPR Article 33 notification obligations, elevating the business impact well beyond what the score implies. No signals conflict here; all sources are consistent.

A publicly available exploit exists via WPScan. An attacker self-registers a free subscriber account on any WordPress site running Easy Appointments ≤ 3.12.26 with open registration enabled, then issues a series of authenticated HTTP requests to the plugin's customer-detail endpoint, incrementing the customer ID parameter with each request. Within minutes the attacker can harvest names, contact details, and appointment history for the site's entire customer base without any further privileges.