CVE-2026-14226: Easy Appointments Information Disclosure

CVE-2026-14226 Overview

CVE-2026-14226 is a broken access control vulnerability in the Easy Appointments WordPress plugin through version 3.12.26. The plugin exposes a REST endpoint that lists appointments but only requires a capability held by every authenticated user. Attackers with subscriber-level access can read all bookings on the site, including customer names, schedules, and appointment statuses. The flaw affects sites where subscriber registration is enabled or where any low-privileged account is compromised.

Critical Impact
Any authenticated user, including subscribers, can enumerate all customer appointment records through an insufficiently protected REST endpoint.

Affected Products

Easy Appointments WordPress plugin versions up to and including 3.12.26

Discovery Timeline

2026-07-30 - CVE-2026-14226 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-14226

Vulnerability Analysis

The Easy Appointments plugin registers a REST API endpoint that returns the appointment list for the site. The endpoint enforces a permission check, but the required capability is one held by every authenticated WordPress user, including the default subscriber role. As a result, the endpoint fails to restrict access to administrators or staff who legitimately need appointment data.

Customer data returned by the endpoint includes personally identifiable information (PII) such as full names, appointment times, and booking statuses. On WordPress sites that allow open user registration, an unauthenticated attacker can create a subscriber account and immediately query the endpoint. The disclosure creates privacy exposure and can support downstream phishing or social engineering against customers.

Root Cause

The root cause is a missing authorization check on a REST route. The permission_callback attached to the appointment-listing route validates only that the caller is logged in, rather than confirming a role-appropriate capability such as manage_options or a dedicated appointment-management capability. This maps to Broken Access Control and Missing Authorization weakness classes.

Attack Vector

Exploitation requires an authenticated session at any privilege level. An attacker registers or compromises a subscriber account, obtains a valid WordPress session or REST nonce, and issues a GET request to the vulnerable appointment-listing REST endpoint. The server returns the full appointment dataset without further authorization checks. No specialized tooling is required beyond an authenticated HTTP client.

See the WPScan Vulnerability Details for endpoint-level technical information.

Detection Methods for CVE-2026-14226

Indicators of Compromise

Unexpected authenticated REST API requests to Easy Appointments routes originating from subscriber role accounts.
Newly registered low-privileged accounts followed by REST calls enumerating appointment records.
Bulk GET requests to /wp-json/ paths associated with the Easy Appointments plugin from a single IP or session.

Detection Strategies

Review WordPress access logs for requests to Easy Appointments REST endpoints correlated with non-administrative user IDs.
Alert on any subscriber-role account issuing REST calls that return large JSON payloads containing appointment fields.
Baseline normal REST consumers for the plugin and flag deviations, such as calls from user accounts that never previously accessed the endpoint.

Monitoring Recommendations

Enable WordPress audit logging for REST API activity and user role changes.
Forward web server and WordPress logs to a centralized analytics platform for correlation across authentication and REST access events.
Monitor new user registrations on sites where open subscriber registration is enabled and correlate with subsequent REST activity.

How to Mitigate CVE-2026-14226

Immediate Actions Required

Update the Easy Appointments plugin to a version later than 3.12.26 once a fixed release is available from the vendor.
Audit existing WordPress user accounts and remove unused or suspicious subscriber-level accounts.
Disable open user registration on sites that do not require it by unchecking Settings → General → Membership.

Patch Information

At the time of publication, refer to the WPScan Vulnerability Details advisory for the latest fixed version information and vendor response for Easy Appointments.

Workarounds

Restrict access to the WordPress REST API for low-privileged roles using a security plugin or custom permission_callback filter.
Temporarily deactivate the Easy Appointments plugin if appointment functionality is not currently in use.
Place the /wp-json/ endpoints behind IP allowlisting or a web application firewall rule that blocks subscriber-level access to appointment routes.

bash

# Example WAF-style rule concept: deny non-admin sessions to the appointment REST route
# Adapt to your WAF or reverse proxy syntax
location ~ ^/wp-json/easyappointments/ {
    if ($cookie_wordpress_logged_in_role !~ "administrator|editor") {
        return 403;
    }
}