Easy Appointments permits Contributor-level shortcode allowlist bypass
Easy Appointments through 3.12.26 validates shortcode input in a block-rendering action by checking only the first tag against an allowlist, then renders the entire string. A logged-in Contributor can begin with an allowed tag, append another registered shortcode and cause it to execute. Impact depends on registered shortcodes. The action, input parameter, allowed tag, renderer and demonstrated secondary shortcode are not disclosed. The 3.12.28 changelog fixes the bypass; 3.12.27 is not confirmed safe.
- Component
- Easy Appointments
- Plugin slug
easy-appointments- Affected
- < 3.12.28
- Safe version
3.12.28- Published
- Aug 06, 2026
This CVE was published Aug 06, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
Update Easy Appointments to 3.12.28 or later; do not treat 3.12.27 as confirmed safe. Restrict Contributor access until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Appointments WordPress plugin before 3.12.28 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N