Easy Appointments CVE-2026-14226

Exploitation requires possession of a valid WordPress account with at minimum subscriber-level access - the lowest role in WordPress's role hierarchy. On sites with open user registration enabled, an external attacker can self-register this account, making exploitation effectively unauthenticated from a practical perspective. The Easy Appointments plugin must be installed and active; the vulnerable REST endpoint is exposed by default upon plugin activation with no special configuration required. Exploitation is concretely limited by the following: sites with closed user registration that do not permit self-signup are protected from external attackers, reducing exposure to insiders or scenarios involving credential theft. No specific plugin configuration, feature flag, or non-default setting enables the vulnerability - it is present in any standard deployment of affected versions.

The CVSS 3.1 score of 4.3 Medium with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is appropriately calibrated. The network attack vector and low attack complexity confirm this is remotely exploitable with minimal skill, but the PR:L requirement (valid WordPress account) is a meaningful barrier. SSVC designates the technical impact as 'partial' and automatable as 'no', consistent with the authentication prerequisite preventing fully unauthenticated mass scanning. EPSS at 0.16% (5th percentile) indicates this CVE has not been widely observed in exploitation telemetry, and it is absent from CISA KEV - so confirmed active exploitation is not established. The primary real-world risk is elevated on WordPress sites with open user registration, where an external attacker can self-register a subscriber account and immediately exploit the endpoint. For sites with closed registration, risk is limited to insider threats or scenarios involving compromised credentials. A public POC from WPScan lowers the bar for exploitation significantly, and the data disclosed - customer names, schedules, booking statuses - constitutes PII with potential GDPR/privacy compliance implications beyond pure security impact.

A publicly available exploit is documented by WPScan. An attacker visits a WordPress site running Easy Appointments ≤ 3.12.26 with open user registration enabled, creates a free subscriber account, then authenticates and issues a direct HTTP GET request to the plugin's appointment-listing REST endpoint using their session credentials. The endpoint returns the complete booking dataset for all customers, exposing names, scheduled times, and appointment statuses without any additional privilege escalation required.