CVE-2026-14223: Easy Appointments Information Disclosure

CVE-2026-14223 Overview

CVE-2026-14223 is a broken access control vulnerability in the Easy Appointments WordPress plugin through version 3.12.26. The plugin fails to verify ownership or capability when returning stored customer details. Any authenticated user with subscriber-level access can read arbitrary customer personal information by iterating a numeric identifier. This falls under Insecure Direct Object Reference [CWE-639] and Broken Access Control [CWE-284] patterns common to WordPress plugin endpoints.

Critical Impact
Authenticated subscribers can enumerate and exfiltrate personal data of every customer stored by the plugin, exposing names, contact details, and appointment metadata.

Affected Products

Easy Appointments WordPress plugin versions up to and including 3.12.26
WordPress sites permitting open subscriber registration and running the vulnerable plugin
Any deployment exposing the plugin's customer-detail endpoint to authenticated low-privilege users

Discovery Timeline

2026-07-30 - CVE-2026-14223 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14223

Vulnerability Analysis

The Easy Appointments plugin exposes an endpoint that returns stored customer records by identifier. The endpoint authenticates the caller but does not authorize the request against the requested record. A subscriber-level user, the lowest authenticated WordPress role, can supply any numeric customer ID and receive the associated personal data. Iterating identifiers from 1 upward enables full enumeration of the customer table. The vulnerability discloses personally identifiable information (PII) collected during appointment booking, including customer names, email addresses, phone numbers, and appointment context.

Root Cause

The plugin implements authentication checks without corresponding authorization checks. The code path verifies that the caller is logged in but omits a capability check such as current_user_can() and does not compare the requested customer ID against the caller's identity. This is a classic Insecure Direct Object Reference where the object identifier is trusted as passed by the client.

Attack Vector

An attacker registers a subscriber account on a target WordPress site, or reuses any compromised low-privilege credential. The attacker then issues authenticated requests to the vulnerable plugin endpoint while incrementing the customer identifier parameter. Each response returns another customer's record. The full attack requires only an HTTP client and a valid session cookie or nonce. No administrative access, chained exploit, or user interaction is required.

Refer to the WPScan Vulnerability Report for endpoint specifics and reproduction steps.

Detection Methods for CVE-2026-14223

Indicators of Compromise

Sequential or high-volume authenticated requests to Easy Appointments AJAX or REST endpoints from a single subscriber account
Access-log entries showing incrementing numeric id parameters against plugin routes such as admin-ajax.php with the plugin's action name
New subscriber registrations followed shortly by bulk plugin endpoint queries
Outbound HTTP responses from the site containing large volumes of customer PII to a single client IP

Detection Strategies

Monitor WordPress access logs for repeated requests to Easy Appointments endpoints with iterating identifier values from the same session
Alert on subscriber-role accounts issuing more than a low threshold of plugin AJAX requests per minute
Compare response payload sizes across identical endpoints; consistent PII-sized responses to a subscriber indicate enumeration
Correlate new user registrations with subsequent plugin endpoint activity within short time windows

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform to enable enumeration-pattern queries
Track subscriber account behavior as a distinct cohort and baseline expected endpoint access
Enable WordPress audit logging plugins to record REST and AJAX invocations with user context
Review any bulk exports of customer records and reconcile them against legitimate administrator activity

How to Mitigate CVE-2026-14223

Immediate Actions Required

Update the Easy Appointments plugin to a version later than 3.12.26 once a patched release is available
Disable open user registration on WordPress sites that do not require it by unchecking Settings → General → Membership
Audit existing subscriber accounts and remove any that are unrecognized or inactive
Review plugin access logs for prior enumeration activity and notify affected customers if PII was exposed

Patch Information

No fixed version is listed in the referenced advisory at time of publication. Consult the WPScan Vulnerability Report for the current patch status and monitor the plugin's WordPress.org listing for updates.

Workarounds

Deactivate the Easy Appointments plugin until a patched version is installed
Restrict access to wp-admin/admin-ajax.php for subscriber-role accounts using a web application firewall rule
Block requests to Easy Appointments endpoints that contain sequential identifier iteration patterns
Enforce reCAPTCHA or manual approval on new user registrations to slow attacker account creation

bash

# Example WAF rule concept blocking rapid subscriber enumeration of the plugin endpoint
# Pseudocode for an ModSecurity-style rule
SecRule REQUEST_URI "@contains admin-ajax.php" \
  "chain,phase:2,deny,status:429,id:1014223,\
   msg:'Easy Appointments enumeration attempt (CVE-2026-14223)'"
  SecRule ARGS:action "@rx eap_" \
    "chain"
    SecRule &SESSION:role "@eq 1" \
      "chain"
      SecRule IP:REQ_COUNT "@gt 20"