EUVD-2026-36952
GHSA-664v-gm8m-vh2f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Remote unauthenticated HTTP request to a WordPress plugin endpoint with missing authorization; broken access control discloses sensitive data (C:H) without modifying or disrupting state.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
AnalysisAI
Unauthenticated information disclosure in the Easy Appointments WordPress plugin (versions ≤ 3.12.21) allows remote attackers to access protected appointment data without authentication due to missing authorization checks. Patchstack reports the issue as a broken access control flaw with high confidentiality impact (CVSS 7.5); no public exploit identified at time of analysis, and the plugin is not currently listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of the Easy Appointments WordPress plugin at versions ≤ 3.12.21, reachable over the public HTTP(S) interface that serves the host WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes a remotely reachable, low-complexity, unauthenticated read primitive with high confidentiality impact and no integrity or availability effect - consistent with mass-scannable WordPress plugin disclosure bugs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker enumerates WordPress sites running Easy Appointments and issues crafted HTTP requests directly to a vulnerable plugin endpoint that lacks an authorization check, retrieving appointment records, customer PII, or other restricted booking data in the response. No public exploit identified at time of analysis, but the low attack complexity and PR:N requirement make automated mass-scan exploitation realistic once endpoint details circulate. |
| Remediation | Patch available per vendor advisory - upgrade Easy Appointments to a release later than 3.12.21 as soon as the maintainer publishes one (consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/easy-appointments/vulnerability/wordpress-easy-appointments-plugin-3-12-21-broken-access-control-vulnerability for the fixed version once listed) and confirm the new version via the WordPress plugin updater. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately disable the Easy Appointments plugin and assess which appointment data may have been accessed by reviewing server logs for suspicious API requests to plugin endpoints. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today