Easy Appointments

An authenticated Contributor or higher role can call handle_customers_ajax and retrieve the full ea_customers dataset, including names, email addresses, phone numbers, dates of birth and physical addresses. The export identifies the handler and table but does not disclose the action registration, parameter or precise authorization defect. Authoritative affected range: <= 3.12.27. Confirmed remediation: 3.12.28.

An unauthenticated attacker can submit an existing appointment ID to the public reservation endpoint and update somebody else's reservation. Follow-on cleanup can delete that appointment. The issue begins in version 4.0; the export does not name the endpoint route or cleanup function. Affected versions reported by the CNA: 4.0 to < 4.0.2.2. The export identifies 4.0.2.2 as fixed.

An unauthenticated attacker who knows or can guess an appointment's creation timestamp can derive email confirmation or cancellation tokens because they use a hard-coded salt. The export does not disclose the token parameter or derivation function. Affected versions reported by the CNA: < 4.0.2.2. The export identifies 4.0.2.2 as fixed.

Easy Appointments through 4.0.2.1 has DOM-based XSS: attacker-controlled input can reach browser-side page processing and execute as script when a victim interacts with the affected content. The CNA rates the attacker as unauthenticated and user interaction as required. The checked WordPress.org release is still 4.0.2.1, within the affected range.

Easy Appointments before 4.0.1 does not restrict an appointment-listing REST endpoint to records belonging to the requesting user. A Contributor can retrieve every booking on the site, including customer names, schedules and appointment statuses.

Easy Appointments through 3.12.26 validates shortcode input in a block-rendering action by checking only the first tag against an allowlist, then renders the entire string. A logged-in Contributor can begin with an allowed tag, append another registered shortcode and cause it to execute. Impact depends on registered shortcodes. The action, input parameter, allowed tag, renderer and demonstrated secondary shortcode are not disclosed. The 3.12.28 changelog fixes the bypass; 3.12.27 is not confirmed safe.

Easy Appointments through 3.12.26 protects /wp-json/easy-appointments/v1/appointments only with a capability held by every authenticated WordPress user. A Subscriber can obtain a wp_rest nonce and supply start, end and title_field parameters to list the full appointment calendar rather than only records associated with that user. The response exposes booking identifiers, customer names, schedules and statuses.

Easy Appointments through 3.12.26 exposes the authenticated AJAX action ea_get_customer_detail without verifying that the caller owns the requested customer or has an administrative capability. When Customer Search is enabled and a page contains the ea_bootstrap shortcode, any logged-in user can scrape the front-end check nonce from ea_settings, submit an attacker-selected id to /wp-admin/admin-ajax.php, and iterate the customer table. A Subscriber can retrieve another customer's name, email address, mobile number, date of birth, and postal address. The exact PHP handler function beyond the AJAX action name is not disclosed by the CNA advisory. Easy Appointments 3.12.28 identifies and fixes the missing customer-ownership check.

Easy Appointments through 3.12.26 registers the ea_delete_multiple_connections AJAX action for users passing its edit_posts registration gate but performs no per-request capability or nonce check. A Contributor can POST JSON containing an attacker-controlled ids array to /wp-admin/admin-ajax.php?action=ea_delete_multiple_connections and delete the selected connection records. Iterating IDs removes all connections, breaking the front-end booking form and disabling normal booking. The missing nonce also permits a forged request against a logged-in Contributor. The exact PHP callback name is not disclosed by the CNA advisory. Version 3.12.28 identifies and fixes unauthorized connection deletion.

Easy Appointments through 3.12.26 exposes appointment-management AJAX actions to users passing its edit_posts registration gate without checking an appointment-specific capability. A Contributor can obtain the generic wp_rest nonce exposed by the block editor, call action=ea_appointments with attacker-selected from and to ranges to retrieve all appointment records and customer name, email, phone, price, and date data, and call action=ea_appointment with an attacker-selected id and _method=DELETE to remove a booking. The same ea_appointment action accepts attacker-controlled booking JSON to create or modify bookings, including location, service, worker, date, start time, status, and price. Subscribers are blocked by the registration gate, and the nonce is required, but every Contributor can obtain it. Exact PHP callback names are not disclosed. Version 3.12.28 fixes the missing authorization on appointment handlers.

Easy Appointments through 3.12.26 exposes the authenticated AJAX action ea_get_customers_ajax to users passing its edit_posts registration gate but performs no per-request capability or nonce check. A Contributor can POST action=ea_get_customers_ajax and an attacker-controlled paged value to /wp-admin/admin-ajax.php, enumerate the response ten records at a time, and retrieve every customer's name, email address, mobile number, date of birth, and postal address from the ea_customers table. Subscribers are blocked by the registration gate. The exact PHP callback name is not disclosed. Version 3.12.28 identifies and fixes the missing authorization on the customer-listing AJAX handler.

Easy Appointments through 3.12.26 exposes the authenticated admin-ajax.php action ea_update_customer_data without verifying that the supplied appointment_id belongs to the current user. A Subscriber who has booked an appointment can obtain the shared ea_edit_appointment_nonce from the REST edit form at /easy-appointments/v1/appointment/, then replay it while supplying another user's appointment_id and attacker-controlled email, name, phone and description values. The action overwrites the victim appointment's customer metadata. If an Administrator later changes that appointment's status while customer notifications are enabled, the plugin sends the victim's appointment notification to the attacker's substituted email address. WPScan reports no known fixed release.

Easy Appointments through 3.12.27 registers the authenticated /wp-admin/admin-ajax.php action ea_delete_multiple_connections but lets the handler read an ids array from the JSON request body and delete the corresponding rows from wp_ea_connections without checking a capability or nonce. Any logged-in attacker with Contributor access can therefore delete arbitrary location-service-worker connection records and disrupt the site's booking configuration.

Easy Appointments is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.12.27.

Easy Appointments is affected by a security weakness. Exploitation requires an authenticated author account. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.12.27.

Easy Appointments is affected by broken access control. The vulnerable path is reachable without authentication. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 3.12.21.

Easy Appointments is affected by sensitive information exposure. The vulnerable path is reachable without authentication. Successful exploitation can disclose data that should not be available to the caller. The published affected range is <= 3.12.21.

Easy Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Easy!Appointments is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Easy Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Easy Appointments is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

Easy Appointments is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Easy Appointments is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

Easy Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Easy!Appointments is affected by sensitive information exposure. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can disclose data that should not be available to the caller.

Easy Appointments is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.