CVE-2026-2262highCWE-200

CVE-2026-2262: falha de alta gravidade em easyappointments Easy Appointments

Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure via REST API

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Easy Appointments

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

36Vexday Risk Score

Corrija em breve. Ela tem exploit funcional público.

ssvc Attendcvss 7.5epss 2.4%
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
easyappointments · Easy Appointments
CVEs relacionadas — easyappointments Easy Appointments

No mesmo produto, das mais perigosas para as menos.

CVE-2026-9232MEDIUMEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX ActionEPSS 0.5%CVE-2026-11992MEDIUMEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment ManipulationEPSS 0.5%CVE-2024-2844MEDIUMEasy Appointments <= 3.11.18 - Insufficient AuthorizationEPSS 0.4%CVE-2026-8789HIGHEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Arbitrary Connection DeletionEPSS 0.4%CVE-2024-2842MEDIUMEasy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site ScriptingEPSS 0.3%