{"id":"CVE-2026-14188","aliases":["EUVD-2026-50981","GHSA-g6jf-96rv-8293"],"status":"published","title":"Easy Appointments \u003c 3.12.28 - Contributor+ Customer Data Disclosure","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00316,"percentile":0.24795,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-07-30T06:00:05Z","modified":"2026-08-10T13:17:56Z","products":[{"vendor":"easyappointments","product":"easy appointments"},{"vendor":"unknown","product":"easy appointments"}],"references":[{"url":"https://wpscan.com/vulnerability/46995079-58df-4c48-871b-eb2f7c8433ce/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14188"},{"url":"https://wpscan.com/vulnerability/46995079-58df-4c48-871b-eb2f7c8433ce"},{"url":"https://github.com/advisories/GHSA-g6jf-96rv-8293"}],"sources":{"cve":[{"id":"CVE-2026-14188","title":"Easy Appointments \u003c 3.12.28 - Contributor+ Customer Data Disclosure","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.","status":"published","published":"2026-07-30T06:00:05.206Z","modified":"2026-08-10T12:42:33.639Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:38:32.13011Z"}],"euvd":[{"id":"EUVD-2026-50981","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.","status":"published","published":"2026-07-30T06:00:05Z","modified":"2026-08-10T12:42:33Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-g6jf-96rv-8293","title":"The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability...","description":"The Easy Appointments WordPress plugin through 3.12.26 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T15:31:47Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:09:56.692541Z"}],"nvd":[{"id":"CVE-2026-14188","description":"The Easy Appointments WordPress plugin before 3.12.28 does not perform a per-request capability or nonce check on one of its customer-listing handlers, allowing authenticated users with contributor-level access to read every stored customer's personal information.","status":"published","published":"2026-07-30T06:24:59.613Z","modified":"2026-08-10T13:17:56.963Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}