Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

published 2026-07-29 3 mo ago modified 2026-08-10 2 mo ago also EUVD-2026-50119

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits: 0; none known

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

Patch / fix

fixed in 1

Unknown Easy Appointments 3.12.28

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 3 mo ago (2026-07-29)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

wpscan.com https://wpscan.com/vulnerability/c39226d5-1b6f-4f08-903c-7ecc67d17eb0/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

Unknown Easy Appointments

Classification

Weakness

CWE-639 Authorization Bypass Through User-Controlled Key

Technology feeds

WordPress rss critical rss

References

wpscan.com /vulnerability/c39226d5-1b6f-4f08-903c-7ecc67d17eb0/
exploit, vdb-entry, technical-description

Sources

CVE List CVE-2026-14224
NVD CVE-2026-14224

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary