ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2262

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the REST API endpoint.

Published Apr 18, 2026 · updated Jun 17, 2026

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the REST API endpoint. This is due to the endpoint being registered with , which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 18, 2026 · NIST NVD

    Detected

    The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the REST API endpoint. This is due to the endpoint being registered with , which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including fu

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the REST API endpoint. This is due to the endpoint being registered with , which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including fu

Sources

  • CVE.orgVulnerability recordCVE-2026-2262

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-2262

    The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the REST API endpoint. This is due to the endpoint being registered with `'permission_callback'

    nvd.nist.gov

References