CVE-2026-14223 — Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

CVE-2026-14223

Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR PUBLISHED

Description (CNA)

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

Affected (CNA)

Vendor / product	Versions
Unknown / Easy Appointments	affected 0 before 3.12.28

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/28b71d3e-5034-42d9-8044-68c90731d38f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.