Easy Appointments CVE-2026-39513

No special conditions - remote unauthenticated exploitation against default configurations of the Easy Appointments WordPress plugin at versions ≤ 3.12.21, reachable over the public HTTP(S) interface that serves the host WordPress site. Limiting factors: the target WordPress installation must have the Easy Appointments plugin installed and activated, must be running 3.12.21 or earlier, and the vulnerable endpoint must be network-reachable (not behind an IP allowlist or authenticated reverse proxy); the CVSS vector indicates no user interaction and no privileges are required.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a remotely reachable, low-complexity, unauthenticated read primitive with high confidentiality impact and no integrity or availability effect - consistent with mass-scannable WordPress plugin disclosure bugs. EPSS, SSVC, and KEV signals were not provided in the input, so probabilistic exploitation likelihood cannot be quantified, but WordPress plugin authorization bypasses with PR:N historically attract opportunistic scanning quickly after disclosure. Patchstack - the reporting source and a credible WordPress vulnerability tracker - confirms the affected version range, but the absence of a referenced changelog, GitHub commit, or wordpress.org release note means the existence of a fixed version cannot be independently verified from the data provided.

An unauthenticated attacker enumerates WordPress sites running Easy Appointments and issues crafted HTTP requests directly to a vulnerable plugin endpoint that lacks an authorization check, retrieving appointment records, customer PII, or other restricted booking data in the response. No public exploit identified at time of analysis, but the low attack complexity and PR:N requirement make automated mass-scan exploitation realistic once endpoint details circulate.