Security Alert Summary
The Easy Appointments WordPress plugin contains a sensitive information exposure vulnerability that allows unauthenticated access to appointment data via a publicly registered REST API endpoint. The issue can disclose customer names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.
CVE Details
- CVE ID: CVE-2026-2262
- Affected component: Easy Appointments plugin for WordPress
- Affected versions: All versions up to and including 3.12.21
- Published: April 18, 2026 12:16:36 AM
- Last modified: April 18, 2026 12:16:36 AM
- CVSS v3.1 Base Score: 7.5
- Severity: HIGH
- Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User Interaction: None required (PR:N, UI:N)
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-200 (Exposure of Sensitive Information)
Technical Details
The vulnerability is caused by a REST API endpoint being registered without any permission checks. The endpoint /wp-json/wp/v2/eablocks/ea_appointments/ is registered with 'permission_callback' => '__return_true', which effectively allows unrestricted access to the endpoint. Because no authentication or authorization is enforced, unauthenticated requests can retrieve stored appointment records.
Exposed data items identified in the advisory include full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information. The issue exists in all versions up to and including 3.12.21 as noted in the affected versions list.
How This Could Impact Your Website
On a typical site using Easy Appointments, the site owner configures appointment booking while staff or external contributors manage schedules and customer communications. With this vulnerability, an unauthenticated actor can access customer appointment records that may include contact information and notes entered during booking.
Practical consequences include exposure of customer email addresses and phone numbers, which can increase the risk of targeted phishing or social engineering against customers or staff. If appointment notes contain sensitive details, those could also be disclosed. The issue affects confidentiality primarily; it does not indicate modification or deletion of data based on the provided information.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Temporarily disable or restrict public access to the bookings/appointments REST endpoints if possible until an update is applied.
- Review and reduce unnecessary user roles and permissions, especially for contributors and non-administrative accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and access logs for unusual behavior or requests to the affected endpoint.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.19/ea-blocks/ea-blocks.php#L141
- https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.19/ea-blocks/ea-blocks.php#L190
- https://plugins.trac.wordpress.org/browser/easy-appointments/trunk/ea-blocks/ea-blocks.php#L190
- https://plugins.trac.wordpress.org/changeset/3485692/easy-appointments/trunk/ea-blocks/ea-blocks.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Feasy-appointments/tags/3.12.21&new_path=%2Feasy-appointments/tags/3.12.22
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e681aa8e-522e-4092-aa1f-8ada3097c8d6?source=cve
