Easy Appointments lets contributors read and manipulate all bookings

Easy Appointments through 3.12.26 exposes appointment-management AJAX actions to users passing its edit_posts registration gate without checking an appointment-specific capability. A Contributor can obtain the generic wp_rest nonce exposed by the block editor, call action=ea_appointments with attacker-selected from and to ranges to retrieve all appointment records and customer name, email, phone, price, and date data, and call action=ea_appointment with an attacker-selected id and _method=DELETE to remove a booking. The same ea_appointment action accepts attacker-controlled booking JSON to create or modify bookings, including location, service, worker, date, start time, status, and price. Subscribers are blocked by the registration gate, and the nonce is required, but every Contributor can obtain it. Exact PHP callback names are not disclosed. Version 3.12.28 fixes the missing authorization on appointment handlers.