{"id":"CVE-2026-19406","aliases":["EUVD-2026-62288","GHSA-2x6x-6h49-pf6q"],"status":"published","title":"Easy Appointments \u003c 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing","description":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00316,"percentile":0.24794,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-200"],"published":"2026-08-19T06:00:20Z","modified":"2026-10-22T16:09:59Z","products":[{"vendor":"easyappointments","product":"easy appointments"},{"vendor":"unknown","product":"easy appointments"}],"references":[{"url":"https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19406"},{"url":"https://wpscan.com/vulnerability/53cfb207-8f26-438c-a928-bc9271f312f0"},{"url":"https://github.com/advisories/GHSA-2x6x-6h49-pf6q"}],"sources":{"cve":[{"id":"CVE-2026-19406","title":"Easy Appointments \u003c 4.0.1 - Contributor+ Sensitive Information Disclosure via REST Appointments Listing","description":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-08-19T06:00:20.837Z","modified":"2026-08-19T16:34:36.19Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"adp"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-62288","description":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-08-19T06:00:20Z","modified":"2026-08-19T16:34:36Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:41.405951Z"}],"ghsa":[{"id":"GHSA-2x6x-6h49-pf6q","title":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment...","description":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-08-19T06:31:18Z","modified":"2026-08-19T18:32:45Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:10:43.503566Z"}],"nvd":[{"id":"CVE-2026-19406","description":"The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.","status":"published","published":"2026-08-19T06:17:39.58Z","modified":"2026-10-22T16:09:59.56Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:12:39.620837Z"}]}}