# Easy Appointments <= 4.0.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Customer Data Exposure via Booking Email

- **ID:** WPSEC-2026-1458
- **Plugin:** Easy Appointments (`easy-appointments`), https://wordpress.org/plugins/easy-appointments/
- **Affected versions:** all versions before 4.0.4
- **Fixed in:** 4.0.4 (Update to 4.0.4 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/easy-appointments
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1458/

## Description

The Easy Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the ea_get_customer_detail and ea_search_customers AJAX actions in all versions up to, and including, 4.0.3. When a booking is completed, the plugin adds the current user's ID to any existing customer record whose email matches the booking email, without checking that the user owns that email. The customer detail and search endpoints then trust that link for authorization. This makes it possible for authenticated attackers, with subscriber-level access and above, to make a booking with a victim's email address and then read the victim's customer record, including name, email address, phone number and address.

## References

- https://wpsec.com/vuln/WPSEC-2026-1458/
- https://plugins.svn.wordpress.org/easy-appointments/tags/4.0.4/
- https://wordpress.org/plugins/easy-appointments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1458/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.