CVE-2026-14223: Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR
Published Jul 30, 2026
·Updated
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
Affected Software
1 affected component
WordPress Easy Appointments<3.12.28
Event History
Jul 30, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:25 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-14223?
The severity of CVE-2026-14223 is rated as medium with a CVSS score of 4.3.
2
How do I fix CVE-2026-14223?
To fix CVE-2026-14223, update the Easy Appointments plugin to a version newer than 3.12.26.
3
What type of information is exposed in CVE-2026-14223?
CVE-2026-14223 exposes customer personally identifiable information (PII) to unauthorized users.
4
Who is affected by CVE-2026-14223?
Users with subscriber-level access in the Easy Appointments plugin are affected by CVE-2026-14223.
5
What conditions allow the exploitation of CVE-2026-14223?
CVE-2026-14223 can be exploited when the plugin does not verify ownership or capability before returning customer details.