WordPress security changelog
MEDIUM CVE-2026-9232 Deferred

Easy Appointments customer AJAX access exposes personal records

An authenticated Contributor or higher role can call handle_customers_ajax and retrieve the full ea_customers dataset, including names, email addresses, phone numbers, dates of birth and physical addresses. The export identifies the handler and table but does not disclose the action registration, parameter or precise authorization defect. Authoritative affected range: <= 3.12.27. Confirmed remediation: 3.12.28.

CVE / CNA score 6.5 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Easy Appointments
Plugin slug
easy-appointments
Affected
<= 3.12.27
Safe version
3.12.28
Published
Sep 19, 2026
Weakness
CWE-862 — Missing Authorization

This CVE was published Sep 19, 2026 and is one of 26 known issues for this plugin.

What to do

Update, patch or deactivate.

Confirmed fixed release: 3.12.28. The release fixes missing authorization on the customer-listing AJAX handler and the resulting personal-data exposure. Official changelog: https://wordpress.org/plugins/easy-appointments/#developers . Restrict customer-data access to the intended appointment-management capability, enforce record scope and return only needed fields. Disable affected customer lookup until updated and assess possible personal-data exposure.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Primary and upstream sources