CVE-2026-19406
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.
Risk Assessment
Disclosure of booking data can violate customer privacy and enable social engineering or competitive attacks.
Recommendation
Update the Easy Appointments plugin to version 4.0.1 or later. Limit the number of accounts with elevated privileges.
Original NVD description (English source)
The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.