CVE-2026-9232: Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handlecustomersajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the eacustomers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
Affected Software
Event History
Frequently Asked Questions
Which users could exploit this issue?
An authenticated user with the Contributor role or any higher-level role could exploit it. No user interaction is required.
How can I determine whether my installation is affected?
Installations running Easy Appointments version 3.12.27 or earlier are affected.
What information could be exposed if the issue is exploited?
An attacker could extract the full customer dataset from the ea_customers table, including names, email addresses, mobile numbers, dates of birth, and physical addresses.