{
 "id": "WPSEC-2026-1458",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1458/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1458/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1458/index.md",
 "title": "Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email",
 "description": "The Easy Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ea_get_customer_detail and ea_search_customers AJAX actions in all versions up to, and including, 4.0.3. When a booking is completed, the plugin adds the current user's ID to any existing customer record whose email matches the booking email, without checking that the user owns that email. The customer detail and search endpoints then trust that link for authorization. This makes it possible for authenticated attackers, with subscriber-level access and above, to make a booking with a victim's email address and then read the victim's customer record, including name, email address, phone number and address.",
 "plugin": {
  "slug": "easy-appointments",
  "name": "Easy Appointments",
  "full_name": "Easy Appointments",
  "wordpress_org": "https://wordpress.org/plugins/easy-appointments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/easy-appointments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/easy-appointments"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.0.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.0.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.0.4",
 "remediation": "Update to 4.0.4 or later.",
 "fix_released": "2026-10-21T13:27:17+00:00",
 "published": "2026-10-22T13:52:08+00:00",
 "updated": "2026-10-22T10:09:29.696908+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1458/",
  "https://plugins.svn.wordpress.org/easy-appointments/tags/4.0.4/",
  "https://wordpress.org/plugins/easy-appointments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/easy-appointments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-22"
 }
}