CVE-2026-14223mediumCWE-639

CVE-2026-14223: medium-severity vulnerability in Easy Appointments

Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

Published · Updated

Follow this CVE+ Monitor Easy Appointments

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.3epss 0.3%
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Easy Appointments
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Easy Appointments

In the same product, most dangerous first.

CVE-2022-4668MEDIUMEasy Appointments < 3.11.2 - Contributor+ Stored XSS in ShortcodeEPSS 0.5%CVE-2026-14222LOWEasy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing AuthorizationEPSS 0.3%CVE-2026-19406LOWEasy Appointments < 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments ListingEPSS 0.3%CVE-2026-14225LOWEasy Appointments < 3.12.28 - Contributor+ Shortcode Allowlist BypassEPSS 0.3%CVE-2026-14188LOWEasy Appointments < 3.12.28 - Contributor+ Customer Data DisclosureEPSS 0.3%CVE-2026-87966MEDIUMEasy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary Appointment Modification and Deletion via IDOREPSS 0.3%