CVE-2026-9232: WordPress Easy Appointments Plugin Data Leak

CVE-2026-9232 Overview

The Easy Appointments plugin for WordPress contains a sensitive information exposure vulnerability affecting all versions up to and including 3.12.27. The flaw resides in the handle_customers_ajax function, which fails to enforce proper capability checks before returning customer data. Authenticated users with contributor-level access or higher can invoke the endpoint and extract the entire contents of the ea_customers table. Exposed records include names, email addresses, mobile numbers, dates of birth, and physical addresses. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
Any authenticated contributor can exfiltrate the complete customer dataset, including personally identifiable information (PII), from vulnerable WordPress sites.

Affected Products

WordPress Easy Appointments plugin versions ≤ 3.12.27
WordPress installations exposing contributor-or-higher accounts
Sites running vulnerable versions 3.12.22 and 3.12.25 referenced in the source

Discovery Timeline

2026-09-19 - CVE-2026-9232 published to the National Vulnerability Database (NVD)
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-9232

Vulnerability Analysis

The Easy Appointments plugin registers an AJAX handler, handle_customers_ajax, intended to serve customer information to authorized staff. The handler processes requests without verifying that the calling user holds an administrative or staff-level capability appropriate for accessing PII. Because WordPress treats any logged-in user as authenticated for wp_ajax_* actions, contributors and higher roles can invoke the endpoint directly.

Once invoked, the handler queries the ea_customers table and returns the full result set to the client. There is no per-row filtering, pagination gating, or role-based restriction on the response. Attackers gain a complete PII dump in a single request, enabling downstream phishing, identity fraud, or regulatory violations under frameworks such as GDPR and CCPA. Review the Wordfence advisory for coverage of the disclosure.

Root Cause

The root cause is a missing authorization check in the AJAX handler. The plugin relies on nonce validation or authentication state without confirming that the caller possesses the WordPress capability required to read customer records. This aligns with CWE-862, where a security-relevant action executes without verifying that the actor is entitled to perform it.

Attack Vector

An attacker must first hold a WordPress account with contributor privileges or higher. Contributor accounts are commonly created for guest bloggers and outsourced content teams, making them a realistic foothold. The attacker submits an authenticated request to the admin-ajax.php endpoint with the vulnerable action parameter and receives the serialized customer table in the response. The vulnerable code paths are visible in the plugin source, including ajax.php line 115, line 183, and line 2656.

No verified public exploit code is available. The vulnerability is described in prose per verified sources; see the WordPress patch changeset #3595856 for the fix.

Detection Methods for CVE-2026-9232

Indicators of Compromise

Unusual POST requests to wp-admin/admin-ajax.php with the Easy Appointments customer action parameter, originating from contributor or author accounts.
Large response payloads from admin-ajax.php returning JSON structures containing email, phone, and address fields.
Bursts of successful AJAX responses from a single low-privilege session within short time windows.

Detection Strategies

Audit web server access logs for authenticated admin-ajax.php calls invoking Easy Appointments handlers by non-administrator users.
Correlate WordPress user activity logs with AJAX traffic to flag contributor accounts querying customer endpoints.
Deploy a web application firewall rule that inspects request bodies for the vulnerable action name and enforces a role check upstream.

Monitoring Recommendations

Alert on any contributor, author, or editor account issuing more than a small threshold of admin-ajax.php calls per minute.
Track outbound response sizes for admin-ajax.php and investigate anomalies compared to a baseline of expected AJAX payloads.
Enable WordPress audit logging plugins to record every AJAX action per user, including timestamp, IP, and user agent.

How to Mitigate CVE-2026-9232

Immediate Actions Required

Upgrade the Easy Appointments plugin to a version later than 3.12.27 that contains the fix from changeset #3595856.
Review all WordPress accounts with contributor role or higher and revoke unnecessary access.
Rotate credentials for any low-privilege accounts that could have been misused prior to patching.

Patch Information

The vendor addressed the missing authorization flaw in WordPress changeset #3595856. Site administrators should update through the WordPress plugin dashboard or by deploying the fixed release via automated configuration management. Confirm the installed version is greater than 3.12.27 after the update.

Workarounds

Temporarily deactivate the Easy Appointments plugin until the patched version is deployed.
Restrict access to wp-admin/admin-ajax.php behind a web application firewall rule that blocks the vulnerable action for non-administrator sessions.
Reduce the number of contributor-level accounts and require multi-factor authentication for all WordPress logins.

bash

# Configuration example: WP-CLI update and role audit
wp plugin update easy-appointments
wp plugin get easy-appointments --field=version
wp user list --role=contributor --fields=ID,user_login,user_email