CVE-2026-14188

LowCVSS 2.7

Published: 30/07/2026(UTC)Updated: 10/08/2026(UTC)Translated: 10/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

15th percentile - higher than 15% of all known CVEs

Summary

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks per-request capability and nonce checks on a customer-listing handler, allowing authenticated contributor-level users to read all stored customers' personal information.

Risk Assessment

Exposure of customers' personal data may violate privacy and lead to legal consequences.

Recommendation

Update the Easy Appointments plugin to version 3.12.28 or later.

Original NVD description (English source)

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.