Easy Appointments REST listing exposes all bookings to Subscribers
Easy Appointments through 3.12.26 protects /wp-json/easy-appointments/v1/appointments only with a capability held by every authenticated WordPress user. A Subscriber can obtain a wp_rest nonce and supply start, end and title_field parameters to list the full appointment calendar rather than only records associated with that user. The response exposes booking identifiers, customer names, schedules and statuses.
- Component
- Easy Appointments
- Plugin slug
easy-appointments- Affected
- < 3.12.28
- Safe version
- See mitigation notes
- Published
- Jul 30, 2026
This CVE was published Jul 30, 2026 and is one of 26 known issues for this plugin.
Update, patch or deactivate.
No fixed public release is identified for this Easy Appointments REST issue through 3.12.26. Restrict WordPress accounts to trusted users or deactivate the plugin when that is warranted until the vendor identifies a release with an appropriately privileged REST permission check. Review exposed bookings and notify affected customers according to the site's incident-response obligations if this data may have been accessed.
No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N