CVE-2026-14221 — Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization

CVE-2026-14221

Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization PUBLISHED

Description (CNA)

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.

Affected (CNA)

Vendor / product	Versions
Unknown / Easy Appointments	affected 0 through 4.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/0ab7d35e-4552-4da0-857e-7fb56e576494/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.