CVE-2026-14188 — Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure

CVE-2026-14188

Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure PUBLISHED

Description (CNA)

The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.

Affected (CNA)

Vendor / product	Versions
Unknown / Easy Appointments	affected 0 before 3.12.28

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/46995079-58df-4c48-871b-eb2f7c8433ce/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.