What is the CVSS score of CVE-2026-2262?

CVE-2026-2262 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2262?

WordPress Easy Appointments plugin versions 3.12.21 and earlier contain an unauthenticated REST API vulnerability that exposes customer personal data including names, emails, phone numbers, and…

Is there a public PoC exploit available for CVE-2026-2262?

Yes, a public proof-of-concept exploit is available for CVE-2026-2262. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-2262?

Within 24 hours: Identify all WordPress instances running Easy Appointments ≤3.12.21 using inventory/scanning tools; document affected sites and customer data volume. Within 7 days: Update Easy Appointments plugin to version 3.12.22 or later on all affected WordPress installations; verify update completion via admin dashboard version checks. Within 30 days: Conduct access logs review for unauthorized `/wp-json/wp/v2/eablocks/ea_appointments/` requests; assess whether customer data exposure warrants notification under applicable privacy regulations.

WordPress CVE-2026-2262

EUVD-2026-23577 HIGH

Information Exposure (CWE-200)

2026-04-18 security@wordfence.com

Information Disclosure WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 20:37 vuln.today

cvss_changed

PoC Detected

Apr 22, 2026 - 20:22 vuln.today

Public exploit code

Analysis Generated

Apr 18, 2026 - 00:38 vuln.today

EUVD ID Assigned

Apr 18, 2026 - 00:22 euvd

EUVD-2026-23577

Analysis Generated

Apr 18, 2026 - 00:22 vuln.today

CVE Published

Apr 18, 2026 - 00:16 nvd

HIGH 7.5

DescriptionCVE.org

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the /wp-json/wp/v2/eablocks/ea_appointments/ REST API endpoint. This is due to the endpoint being registered with 'permission_callback' => '__return_true', which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.

AnalysisAI

Unauthenticated information disclosure in WordPress Easy Appointments plugin ≤3.12.21 exposes customer appointment data via unprotected REST API endpoint. Remote attackers without authentication can extract full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information through /wp-json/wp/v2/eablocks/ea_appointments/. CVSS score 7.5 (High) with EPSS data not yet available. Patch released in version 3.12.22 per WordPress plugin repository changeset. No active exploitation confirmed (not in CISA KEV), but the trivial exploit complexity (AV:N/AC:L/PR:N/UI:N) and privacy impact make this a priority for sites handling sensitive appointment data.

Technical ContextAI

WordPress REST API endpoints require proper permission callbacks to enforce access controls. This vulnerability stems from registering the /wp-json/wp/v2/eablocks/ea_appointments/ endpoint in ea-blocks.php with 'permission_callback' => '__return_true' - a function that unconditionally returns true, effectively bypassing all authentication and authorization checks. Per WordPress REST API architecture, permission callbacks are the primary security boundary for custom endpoints. The __return_true pattern is sometimes used during development but should never be deployed in production for sensitive data endpoints. The CWE-200 classification (Exposure of Sensitive Information to an Unauthorized Actor) accurately describes the root cause. Source code references point to lines 141 and 190 in ea-blocks/ea-blocks.php where the vulnerable endpoint registration occurs. The plugin manages appointment scheduling for WordPress sites, making customer PII (personally identifiable information) the primary data at risk.

RemediationAI

Upgrade Easy Appointments plugin to version 3.12.22 immediately via WordPress admin dashboard (Plugins → Updates) or by downloading from the official WordPress plugin repository. The fix is documented in changeset 3485692 which replaces the vulnerable 'permission_callback' => '__return_true' with proper authorization checks. If immediate upgrade is not feasible, implement these compensating controls with noted trade-offs: (1) Disable the Easy Appointments plugin entirely until upgrade is possible - this prevents appointment booking functionality but fully mitigates data exposure. (2) Use Web Application Firewall (WAF) or security plugin rules to block HTTP requests to /wp-json/wp/v2/eablocks/ea_appointments/ path for non-authenticated users - requires careful rule testing to avoid blocking legitimate appointment management. (3) Restrict WordPress REST API access to authenticated users only via plugin like Disable REST API - this may break other legitimate API integrations. After patching, audit server logs for unauthorized access to the vulnerable endpoint pattern to identify potential prior data exposure. Source code comparison at https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-appointments/tags/3.12.21&new_path=%2Feasy-appointments/tags/3.12.22 shows exact fix implementation.