Easy Appointments exposes the complete customer list to contributors
Easy Appointments through 3.12.26 exposes the authenticated AJAX action ea_get_customers_ajax to users passing its edit_posts registration gate but performs no per-request capability or nonce check. A Contributor can POST action=ea_get_customers_ajax and an attacker-controlled paged value to /wp-admin/admin-ajax.php, enumerate the response ten records at a time, and retrieve every customer's name, email address, mobile number, date of birth, and postal address from the ea_customers table. Subscribers are blocked by the registration gate. The exact PHP callback name is not disclosed. Version 3.12.28 identifies and fixes the missing authorization on the customer-listing AJAX handler.
- Component
- Easy Appointments
- Plugin slug
easy-appointments- Affected
- < 3.12.28
- Safe version
3.12.28- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update Easy Appointments to 3.12.28 or later. Review requests with action=ea_get_customers_ajax from non-administrator accounts and assess the stored customer dataset for reportable personal-data exposure.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N