Sensitive Information Exposure in Easy Appointments Plugin for WordPress

CVE-2026-2262

What is CVE-2026-2262?

The Easy Appointments plugin for WordPress is vulnerable to a serious issue where sensitive customer information can be exposed. All versions up to and including 3.12.21 are affected due to a flaw in the REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/. Specifically, this endpoint lacks proper authentication or authorization checks since it is registered with a permission callback that allows unrestricted access. This vulnerability enables malicious actors to potentially extract sensitive data such as customers' full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information, presenting significant risk to user privacy and data security.

References