CVE-2026-14224 Easy Appointments CVE debrief

Who should care

Administrators and users of the Easy Appointments WordPress plugin, especially those with subscriber-level access, should be aware of this vulnerability and take necessary defensive actions to prevent targeted attacks.

Technical summary

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment.

Defensive priority

Medium-priority defensive actions are recommended due to the CVSS score of 5.4 and the potential for targeted attacks.

Recommended defensive actions

• Verify and apply the vendor's remediation for the Easy Appointments WordPress plugin version 3.12.28 or later.
• Restrict access to appointment metadata to prevent unauthorized modifications.
• Monitor for suspicious activity related to appointment notifications and customer metadata updates.
• Implement compensating controls to detect and prevent potential attacks.
• Review and update incident response plans to address potential targeted attacks.

Evidence notes

The CVE record and NVD detail provide information about the vulnerability in the Easy Appointments WordPress plugin. The vulnerability allows a subscriber-level user to overwrite customer metadata of another user's appointment, potentially leading to targeted attacks.

Official resources