{"id":"CVE-2026-14221","aliases":["EUVD-2026-50982","GHSA-qw8r-6q92-c4g3"],"status":"published","title":"Easy Appointments \u003c= 4.0 - Contributor+ Appointment Data Disclosure \u0026 Modification via Missing Authorization","description":"The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.","severity":{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00255,"percentile":0.17215,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-07-30T06:00:05Z","modified":"2026-08-10T13:17:57Z","products":[{"vendor":"easyappointments","product":"easy appointments"},{"vendor":"unknown","product":"easy appointments"}],"references":[{"url":"https://wpscan.com/vulnerability/0ab7d35e-4552-4da0-857e-7fb56e576494/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14221"},{"url":"https://wpscan.com/vulnerability/0ab7d35e-4552-4da0-857e-7fb56e576494"},{"url":"https://github.com/advisories/GHSA-qw8r-6q92-c4g3"}],"sources":{"cve":[{"id":"CVE-2026-14221","title":"Easy Appointments \u003c= 4.0 - Contributor+ Appointment Data Disclosure \u0026 Modification via Missing Authorization","description":"The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.","status":"published","published":"2026-07-30T06:00:05.43Z","modified":"2026-08-10T12:42:50.073Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-50982","description":"The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.","status":"published","published":"2026-07-30T06:00:05Z","modified":"2026-08-10T12:42:50Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-qw8r-6q92-c4g3","title":"The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in...","description":"The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T15:32:50Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:09:57.28787Z"}],"nvd":[{"id":"CVE-2026-14221","description":"The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings.","status":"published","published":"2026-07-30T06:24:59.813Z","modified":"2026-08-10T13:17:57.133Z","cvss":[{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}