CVE-2026-2262highCWE-200

CVE-2026-2262: fallo de gravedad alta en easyappointments Easy Appointments

Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Easy Appointments

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 7.5epss 2.4%
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
easyappointments · Easy Appointments
CVEs relacionadas — easyappointments Easy Appointments

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-9232MEDIUMEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX ActionEPSS 0.5%CVE-2026-11992MEDIUMEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment ManipulationEPSS 0.5%CVE-2024-2844MEDIUMEasy Appointments <= 3.11.18 - Insufficient AuthorizationEPSS 0.4%CVE-2026-8789HIGHEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection DeletionEPSS 0.4%CVE-2024-2842MEDIUMEasy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%