CVE-2026-14224: Easy Appointments Auth Bypass Vulnerability

CVE-2026-14224 Overview

CVE-2026-14224 is an Insecure Direct Object Reference (IDOR) vulnerability in the Easy Appointments WordPress plugin through version 3.12.26. The plugin's customer-data update action fails to verify that the target appointment belongs to the current user. It only checks a shared nonce that any authenticated user can retrieve from their own appointment's edit form. A subscriber-level user can reuse that nonce to overwrite another user's appointment metadata, including email, name, phone, and description. When an administrator later changes the appointment status with customer notifications enabled, the victim's notification is delivered to the attacker-controlled email address. The weakness is classified as CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
An authenticated subscriber can hijack appointment notifications belonging to other users, exposing personally identifiable information (PII) contained in appointment communications.

Affected Products

Easy Appointments WordPress plugin, all versions through 3.12.26
WordPress sites permitting subscriber-level registration with the plugin enabled
Deployments using the plugin's built-in customer notification workflow

Discovery Timeline

2026-07-29 - CVE-2026-14224 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14224

Vulnerability Analysis

The Easy Appointments plugin exposes an authenticated action that updates the customer metadata attached to an appointment. The handler validates the request using a nonce shared across the plugin's edit-appointment interface. Any authenticated user with a legitimate appointment can obtain that nonce by loading their own edit form. The handler then trusts the appointment identifier submitted in the request without confirming ownership.

Because the plugin treats the mutable customer metadata (email, name, phone, description) as authoritative contact data, downstream notification logic uses whatever value the attacker supplied. When an administrator subsequently transitions the appointment state and the notification flag is enabled, the plugin dispatches the appointment update email to the attacker-controlled address rather than the legitimate customer.

Root Cause

The root cause is missing object-level authorization on the customer-data update endpoint. The plugin conflates nonce validation with access control. Nonces in WordPress protect against Cross-Site Request Forgery (CSRF); they do not establish that the acting user owns the target object. The handler omits a check comparing the current user identifier against the appointment owner before applying the update.

Attack Vector

An attacker registers or uses an existing subscriber account and creates a valid appointment to receive a working nonce. The attacker then issues an authenticated request to the update action, substituting the appointment identifier of a victim record while keeping the harvested nonce. The plugin overwrites the victim record's contact fields with attacker-supplied values. When the administrator changes the appointment status with notifications enabled, the confirmation email, which may include appointment details and PII, is routed to the attacker.

No verified public exploit or proof-of-concept code was available at the time of publication. Technical details are documented in the WPScan Vulnerability Profile.

Detection Methods for CVE-2026-14224

Indicators of Compromise

Appointment records where the email, name, or phone fields were modified by a user account that does not match the appointment owner.
Outbound notification emails delivered to addresses that differ from the originally booked customer address.
Repeated POST requests to the Easy Appointments customer-data update endpoint originating from a single subscriber session against multiple appointment IDs.

Detection Strategies

Audit the plugin's database tables for recent updates to customer fields and correlate the modifying user against the appointment creator.
Review WordPress action logs (via a logging plugin or web server access logs) for authenticated requests to the plugin's AJAX or admin-ajax endpoints referencing appointment IDs not owned by the caller.
Compare current appointment contact metadata against the original booking values captured in booking confirmation emails or backups.

Monitoring Recommendations

Enable verbose logging on WordPress admin-ajax requests and forward events to a centralized SIEM for correlation.
Alert on subscriber accounts issuing more than one appointment update request within a short interval.
Monitor mail-transfer logs for appointment notifications delivered to newly changed recipient addresses.

How to Mitigate CVE-2026-14224

Immediate Actions Required

Restrict new subscriber registration on affected WordPress sites until the plugin is updated.
Disable the Easy Appointments plugin if subscriber registration cannot be restricted and no patched release is deployed.
Review appointment records created before the mitigation for unauthorized changes to contact metadata and restore known-good values.

Patch Information

No fixed version is identified in the referenced NVD data. Administrators should monitor the WPScan Vulnerability Profile and the plugin's WordPress.org listing for release notes indicating an authorization fix. Apply the vendor patch to all sites running version 3.12.26 or earlier as soon as it becomes available.

Workarounds

Disable the customer notification option for administrator status changes to prevent notification hijacking until a patch is released.
Restrict the appointment booking flow to authenticated staff or administrators, removing the ability for subscriber accounts to obtain a valid nonce.
Deploy a web application firewall (WAF) rule that blocks authenticated requests to the plugin's customer-data update endpoint when the appointment ID does not match a session-bound identifier.

bash

# Temporary containment: deactivate the plugin via WP-CLI
wp plugin deactivate easy-appointments

# Optionally remove the plugin until a fix is available
wp plugin uninstall easy-appointments