What is the CVSS score of EUVD-2026-50981?

EUVD-2026-50981 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a public PoC exploit available for EUVD-2026-50981?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50981. Prioritise patching immediately. EPSS: 0.2%.

Easy Appointments EUVD-2026-50981

| CVE-2026-14188 LOW

Information Exposure (CWE-200)

2026-07-30 WPScan

GHSA-g6jf-96rv-8293

WordPress Information Disclosure Easy Appointments

2.7

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Contributor is a low-privilege WordPress role (PR:L), not admin; impact limited to partial confidentiality of customer records only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 15:37 vuln.today

CVSS changed

Jul 30, 2026 - 15:22 NVD

2.7 (LOW)

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

LOW 2.7

DescriptionCVE.org

The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.

AnalysisAI

Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain contributor-level WordPress account

Delivery

Authenticate and obtain session cookie

Exploit

Send HTTP request to customer-listing handler

Execution

Bypass absent capability and nonce checks

Impact

Receive full customer PII dataset

Access

Obtain contributor-level WordPress account

Delivery

Authenticate and obtain session cookie

Exploit

Send HTTP request to customer-listing handler

Execution

Bypass absent capability and nonce checks

Impact

Receive full customer PII dataset

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated WordPress session with at minimum contributor-level role privileges - a role that permits drafting posts but not publishing or managing users, and is commonly granted on multi-author sites or sites with open registration. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) scores 2.7 and labels the required privilege as High (PR:H), which is inconsistent with the description - contributor is a low-privilege WordPress role, not an administrator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker registers or compromises a contributor account on a target WordPress site running Easy Appointments ≤ 3.12.26. Using the publicly available WPScan proof-of-concept, they send an authenticated HTTP request directly to the unprotected customer-listing handler, bypassing the absent capability and nonce checks, and receive a full dump of stored customer personal information including names and contact details.
Remediation	The primary fix is to upgrade Easy Appointments to a version above 3.12.26 once a patched release is available from the plugin author; no specific patched version has been confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report.