Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email
- ID
- WPSEC-2026-1458
- Plugin
- Easy Appointments (easy-appointments)
- Affected
- all versions before 4.0.4
- Remediation
- Update to 4.0.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Easy Appointments on WPSec AttackSurface
- Fix released
- Published
Description
The Easy Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ea_get_customer_detail and ea_search_customers AJAX actions in all versions up to, and including, 4.0.3. When a booking is completed, the plugin adds the current user's ID to any existing customer record whose email matches the booking email, without checking that the user owns that email. The customer detail and search endpoints then trust that link for authorization. This makes it possible for authenticated attackers, with subscriber-level access and above, to make a booking with a victim's email address and then read the victim's customer record, including name, email address, phone number and address.
References
- https://wpsec.com/vuln/WPSEC-2026-1458/
- https://plugins.svn.wordpress.org/easy-appointments/tags/4.0.4/
- https://wordpress.org/plugins/easy-appointments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS