CVE-2026-14221
LowCVSS 3.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability in the Easy Appointments WordPress plugin through 4.0 lacks capability checks in appointment-management actions, relying only on a nonce, allowing contributor-level users to read all customers' appointment details and to create, modify, and delete bookings.
Risk Assessment
A low-privileged user can access sensitive data and manipulate bookings, potentially leading to data integrity issues.
Recommendation
Update the Easy Appointments plugin to a version newer than 4.0.
Original NVD description (English source)
The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.