{"id":"CVE-2026-14226","aliases":["EUVD-2026-50985","GHSA-vwwh-xjvm-53g2"],"status":"published","title":"Easy Appointments \u003c 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing","description":"The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00295,"percentile":0.22362,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-07-30T06:00:06Z","modified":"2026-08-10T09:17:17Z","products":[{"vendor":"easyappointments","product":"easy appointments"},{"vendor":"unknown","product":"easy appointments"}],"references":[{"url":"https://wpscan.com/vulnerability/fa201b6f-af45-4ce9-aa3b-3688ae556965/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14226"},{"url":"https://wpscan.com/vulnerability/fa201b6f-af45-4ce9-aa3b-3688ae556965"},{"url":"https://github.com/advisories/GHSA-vwwh-xjvm-53g2"}],"sources":{"cve":[{"id":"CVE-2026-14226","title":"Easy Appointments \u003c 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing","description":"The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-07-30T06:00:06.27Z","modified":"2026-08-10T08:02:07.781Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-50985","description":"The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-07-30T06:00:06Z","modified":"2026-08-10T08:02:07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:06.086083Z"}],"ghsa":[{"id":"GHSA-vwwh-xjvm-53g2","title":"The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability...","description":"The Easy Appointments WordPress plugin through 3.12.26 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-07-30T06:32:36Z","modified":"2026-07-30T21:32:50Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:09:59.177116Z"}],"nvd":[{"id":"CVE-2026-14226","description":"The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-07-30T06:25:00.117Z","modified":"2026-08-10T09:17:17.943Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:33.955581Z"}]}}