EUVD-2026-50119
GHSA-hqv9-x7qp-69hr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
PR:L required for subscriber account and own appointment; C:L reflects notification content exposure to attacker; no availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The Easy Appointments WordPress plugin through 3.12.26 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin through 3.12.26 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
AnalysisAI
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Technical ContextAI
The root cause is CWE-639 (Authorization Through User-Controlled Key): the plugin's customer-data update action authenticates the request using a WordPress nonce obtained from the appointment edit form, but that nonce is shared rather than appointment-scoped. Any authenticated user can retrieve a valid nonce from their own appointment and replay it against a different appointment ID, bypassing the ownership check entirely. The affected component is the Easy Appointments plugin for WordPress, a booking and scheduling tool. The CPE string (cpe:2.3:a:unknown:easy_appointments:*:*:*:*:*:*:*:*) reflects an unmapped NVD vendor entry, with all versions through 3.12.26 confirmed vulnerable per EUVD-2026-50119. The injectable fields - email, name, phone, description - are subsequently consumed by the notification subsystem as authoritative contact data, enabling the metadata-to-notification-redirect chain described in the vulnerability.
RemediationAI
No vendor-released patched version has been confirmed in available data at time of analysis; site administrators should monitor the WPScan advisory at https://wpscan.com/vulnerability/c39226d5-1b6f-4f08-903c-7ecc67d17eb0/ and the plugin's official changelog for a fix release. As an immediate compensating control, disabling the Easy Appointments plugin entirely eliminates exposure but removes booking functionality. If the plugin must remain active, restricting WordPress user registration to administrators only removes the attacker's ability to obtain a subscriber account and a nonce, substantially reducing risk - though this trade-off prevents self-service bookings. Additionally, disabling customer notification emails for appointment status changes breaks the notification-hijack chain, though it does not prevent the underlying metadata overwrite. Sites running on networks with Web Application Firewalls should consider rate-limiting or monitoring requests to the plugin's AJAX handler for repeated appointment-ID variations from a single authenticated session.
More in Easy Appointments
View allalextselegidis Easy!Appointments v1.5.1 was discovered to contain a SQL injection vulnerability via the order_by paramet
Easy!Appointments 1.3.2 plugin for WordPress allows Sensitive Information Disclosure (Username and Password Hash). Rated
Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authentic
Insecure direct object reference in the Easy Appointments WordPress plugin (all versions through 3.12.26) permits any au
Una
Improper access control in the Easy Appointments WordPress plugin through version 3.12.26 allows any contributor-level W
Broken access control in the Easy Appointments WordPress plugin through version 3.12.26 permits any contributor-level au
Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote atta
Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authe
Unauthenticated IDOR in the Easy Appointments WordPress plugin (versions ≤ 3.12.27) lets remote, unauthenticated attacke
The Easy Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ea_full_calend
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today