Easy Appointments < 3.12.28 – Contributor+ Customer Data Disclosure | CVE 2026-14188

Description

The plugin does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.

Proof of Concept

Prerequisites: a Contributor account; customer records exist in the ea_customers table (created normally via the plugin's public booking form).

Steps (as the attacker, a Contributor):
1. Log in as the Contributor and capture session cookies.
2. Dump customer PII (no nonce required); iterate paged=N for all rows (10 per page):
curl -s -b cookies.txt -d 'action=ea_get_customers_ajax&paged=1' "https://victim.example/wp-admin/admin-ajax.php"

Response returns every customer's name, email, mobile (phone), dob (date of birth), and address as JSON. A Subscriber cannot reach the handler (the action is gated at registration by the edit_posts capability, so Contributor and above).