CVE-2026-14188 — Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated us…
Published: 2026-07-30 · CVSS: 2.7 · CVSS 3.1
The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7