EUVD-2026-54187
GHSA-m9g2-wqhj-c2j4
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Contributor access is PR:L not PR:H; shortcode execution can affect both confidentiality and integrity depending on invoked shortcodes.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
1DescriptionCVE.org
The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.
AnalysisAI
Shortcode allowlist bypass in the Easy Appointments WordPress plugin (≤ 3.12.26) allows authenticated contributors to execute arbitrary registered shortcodes by exploiting a validation flaw in a block-rendering action. The plugin checks only the first tag of a supplied string against an approved shortcode list, but renders the entire string - meaning a contributor can prepend an allowed tag and append any registered shortcode to bypass the restriction entirely. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the vendor-assigned CVSS score of 2.7 (Low) reflects constrained scope, though real-world impact depends on the registered shortcode ecosystem of the targeted site.
Technical ContextAI
The vulnerability resides in a block-rendering action registered by the Easy Appointments WordPress plugin. WordPress shortcodes are developer-registered hooks that render dynamic content when invoked with bracket syntax (e.g., [shortcode_name]). The plugin implements an allowlist intended to restrict which shortcodes contributors may invoke via this rendering path. However, the allowlist check performs a first-tag-only validation - it inspects only the leading shortcode token of the input string and approves the full string if that token is permitted, without parsing or validating subsequent tokens. This is a classic incomplete input validation pattern (structurally analogous to CWE-184, Incomplete List of Disallowed Inputs, though no CWE is formally assigned). The root cause is in the parsing logic: instead of tokenizing and validating every shortcode in the input string, the code short-circuits after the first match. Affected CPE is effectively all Easy Appointments versions from 0 through 3.12.26, per EUVD-2026-54187.
RemediationAI
No vendor-released patch version has been confirmed in the available data at time of analysis. Site administrators should monitor the WPScan advisory (https://wpscan.com/vulnerability/6e95e74b-89b2-4a4f-b8a8-91d7b76cdcd2/) and the plugin's changelog on WordPress.org for a patched release. As an immediate compensating control, restrict contributor-level accounts on affected installations - if no external contributors require access, revoke or demote those roles to Subscriber, which removes access to block-editing actions. Alternatively, deactivate the Easy Appointments plugin until a patched version is released; this eliminates the attack surface entirely at the cost of appointment-booking functionality. Avoid assigning the Contributor role to untrusted users on sites running this plugin. If the plugin cannot be deactivated, audit all registered shortcodes on the site and remove or restrict any that perform sensitive operations, reducing the blast radius of a successful exploitation.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today