WordPress security changelog
MEDIUM CVE-2026-14224 Deferred

Easy Appointments permits subscriber-level modification of other users' appointment data

Easy Appointments through 3.12.26 exposes the authenticated admin-ajax.php action ea_update_customer_data without verifying that the supplied appointment_id belongs to the current user. A Subscriber who has booked an appointment can obtain the shared ea_edit_appointment_nonce from the REST edit form at /easy-appointments/v1/appointment/, then replay it while supplying another user's appointment_id and attacker-controlled email, name, phone and description values. The action overwrites the victim appointment's customer metadata. If an Administrator later changes that appointment's status while customer notifications are enabled, the plugin sends the victim's appointment notification to the attacker's substituted email address. WPScan reports no known fixed release.

CVE / CNA score 5.4 CVSS 3.1 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
NVD score Pending NVD has not published its own CVSS assessment.
Component
Easy Appointments
Plugin slug
easy-appointments
Affected
< 3.12.28
Safe version
See mitigation notes
Published
Jul 29, 2026
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published Jul 29, 2026 and is one of 26 known issues for this plugin.

What to do

Update, patch or deactivate.

No fixed public release is currently identified. Restrict or disable customer appointment editing and customer notifications until an upstream fix is available; if those features cannot be safely isolated, deactivate Easy Appointments. Review appointment customer fields for unauthorized changes and treat notifications sent to substituted addresses as a potential privacy disclosure. If in doubt, contact Fused or your hosting vendor.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

References

Primary and upstream sources