Easy Appointments CVE-2026-14224

Exploitation requires the attacker to hold a valid WordPress account at subscriber level or higher, and to have at least one existing appointment of their own from which to retrieve the shared nonce - this nonce is exposed in the appointment edit form UI. The attacker must know or enumerate a valid appointment ID belonging to another user; no additional privilege is needed to perform the metadata overwrite itself. The notification-hijack second stage additionally requires a site administrator to manually trigger an appointment status change with the customer notification option enabled - without this admin action, the overwritten metadata causes no observable harm beyond the integrity violation. Exploitation is therefore bounded by: (1) open or attacker-accessible WordPress registration, (2) attacker ability to book at least one appointment, and (3) administrator-triggered notification for the full impact chain. Sites that restrict registration or use appointment-approval workflows that do not send notifications are partially mitigated.

The CVSS 3.1 base score of 5.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N accurately reflects the primary constraint: PR:L means the attacker must be an authenticated WordPress subscriber with their own appointment, which is a non-trivial barrier on sites that do not allow open registration. The low complexity (AC:L) and no required user interaction (UI:N) mean that once an attacker has a valid account and appointment, exploitation is straightforward and repeatable. The public POC published by WPScan lowers the effective skill bar significantly. No CISA KEV listing was identified at time of analysis, suggesting no confirmed mass exploitation, though targeted abuse against specific booking entries is plausible. The secondary notification-hijack impact (receiving a victim's appointment confirmation) is real-world consequential beyond a simple data overwrite, as it may expose personally identifiable information in the notification body. Sites that allow public user registration and open appointment booking face higher realistic exposure than invite-only deployments.

An attacker registers a subscriber account on a target WordPress site (or already holds one), books an appointment, and opens the appointment edit form to capture the nonce embedded in the page. They then issue a crafted POST request to the plugin's customer-data update endpoint, substituting a victim's appointment ID while supplying their own email address in the metadata fields; no additional authentication is required beyond the harvested nonce. When a site administrator subsequently changes that appointment's status with customer notifications enabled, the victim's booking confirmation - including appointment time, location, and any other notification-body content - is sent to the attacker's inbox rather than the legitimate customer. A public proof-of-concept demonstrating this technique is available via WPScan.