Easy Appointments exposes customer PII to subscribers through an IDOR
Easy Appointments through 3.12.26 exposes the authenticated AJAX action ea_get_customer_detail without verifying that the caller owns the requested customer or has an administrative capability. When Customer Search is enabled and a page contains the ea_bootstrap shortcode, any logged-in user can scrape the front-end check nonce from ea_settings, submit an attacker-selected id to /wp-admin/admin-ajax.php, and iterate the customer table. A Subscriber can retrieve another customer's name, email address, mobile number, date of birth, and postal address. The exact PHP handler function beyond the AJAX action name is not disclosed by the CNA advisory. Easy Appointments 3.12.28 identifies and fixes the missing customer-ownership check.
- Component
- Easy Appointments
- Plugin slug
easy-appointments- Affected
- < 3.12.28
- Safe version
3.12.28- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update Easy Appointments to 3.12.28 or later. Until updated, disable Customer Search and restrict untrusted user accounts. Review requests with action=ea_get_customer_detail and sequential id values, and assess stored customer records for reportable personal-data exposure.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N