What the vulnerability does
01Description
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.
Explanation of Vulnerability in Simple Terms
02Summary
Easy Appointments versions 3.12.21 and earlier expose sensitive information to unauthenticated attackers over the network. The vulnerability allows direct access to confidential data without requiring user interaction or special network conditions. Site administrators should update to a version newer than 3.12.21 immediately.
What an attacker can do
03Attacker Capabilities
Read sensitive information from the application without authentication.
Potential impact on your site
04Site Impact
Confidential data (user details, appointment records, or system information) may be publicly accessible to anyone.
Conditions required to exploit
05Prerequisites
Network access to the Easy Appointments installation; no authentication required.
Key dates
06Disclosure timeline
April 17, 2026
CVE published
April 20, 2026
Record updated
