WordPress Plugin Vulnerabilities

Easy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing

Description

The plugin does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.

Proof of Concept

Affects Plugins

Plugin icon
easy-appointments
Fixed in 4.0.1

References

CVE
CVE-2026-19406

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Shikhali Jamalzade
Submitter
Shikhali Jamalzade
Submitter website
https://alisalive.vercel.app
Submitter twitter
0xAlisAlive
Verified
Yes
WPVDB ID
53cfb207-8f26-438c-a928-bc9271f312f0

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2026-02-03
Title
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
Published
2026-07-05
Title
Exclusive Addons for Elementor < 2.8.0 - Unauthenticated Information Exposure
Published
2024-05-07
Title
Ghost < 1.5.0 - Unauthenticated Sensitive Information Exposure
Published
2025-01-08
Title
WP Database Backup < 7.4 - Unauthenticated Database Back-Up Exposure
Published
2026-06-11
Title
Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX