CVE-2026-14226
Vulnerability Description
The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.
Vulnerability Details
Published Date
Last Modified
Source
NVD
Vendor
Unknown
Product
Easy Appointments
Discussion (0)
Add Comment
No comments yet. Be the first!