CVE-2026-14223

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

Score

CVSS 3.1 4.3 Medium

Status

Deferred - contact@wpscan.com

Published

2026-07-30

Last modified

2026-08-10

Weaknesses

CWE-639

Affected products

• Easy Appointments (Unknown)

References

• https://wpscan.com/vulnerability/28b71d3e-5034-42d9-8044-68c90731d38f/