rootpwn

medium · CVSS v3 6.5 · EPSS 0.0027

CVE-2026-9232

The Easy Appointments plugin for WordPress up to version 3.12.27 contains a sensitive information exposure vulnerability in its AJAX handlin

Overview

The Easy Appointments plugin for WordPress up to version 3.12.27 contains a sensitive information exposure vulnerability in its AJAX handling functionality. This flaw allows authenticated attackers with low-level contributor privileges to access and extract the complete customer dataset. Consequently, sensitive personally identifiable information can be exfiltrated without proper authorization controls.

Description

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

Impact

This vulnerability impacts the confidentiality of user data stored in the database, specifically targeting the ea_customers table. Organizations utilizing the affected plugin risk unauthorized exposure of customer personally identifiable information, including names, emails, phone numbers, and physical addresses. Integrity and availability remain unaffected, but privacy and compliance obligations are compromised for all affected customers.

Remediation

Upgrade the Easy Appointments plugin to the latest patched version beyond 3.12.27 as soon as the vendor provides a security update. Temporarily restrict contributor-level user registrations and review permissions if patching is delayed. Audit database access logs and monitor for anomalous queries targeting customer data tables.

Risk context

The vulnerability carries a medium CVSS score of 6.5, indicating a moderate technical severity. The current EPSS score is 0.0027, suggesting a low observed likelihood of exploitation in the wild, though internal privilege escalation or misuse by malicious contributors remains a viable risk.

Affected products

  • Easy Appointments plugin for WordPress

Scores

Severity
medium
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
—
EPSS
0.0027

wordpress plugin information-disclosure cve defensive-analysis pii

← All CVEs

Related CVEs

medium

CVE-2026-12042

The WP2Social Auto Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) within its administrative settings. This vulnerability exists in all versions up to 2.4.12 due to inadequate input sanitization and output escaping of user-provided data.

View analysis

medium

CVE-2026-15660

The SEO Booster plugin for WordPress versions up to 7.4.7 suffers from a missing authorization check that allows any authenticated user with Subscriber role or higher to overwrite critical options. This can disrupt the Google Search Console integration and inject attacker‑supplied data into site options. The flaw is exploitable via a crafted /wp-admin/ URL that triggers the vulnerable handle_oauth_callback function.

View analysis

medium

CVE-2026-15760

The Divi Essential plugin for WordPress contains a vulnerability in its AJAX handlers that allows authenticated users to access sensitive database information. Due to missing authorization checks and bypassable security tokens, any user with Subscriber-level access can enumerate and read arbitrary database tables. This exposure includes critical data such as user credentials, session tokens, and site configuration settings.

View analysis

medium

CVE-2025-15698

The Business Name Generator plugin for WordPress, up to version 1.3, contains a vulnerability where configuration settings are not properly sanitized or escaped. This allows high-privileged users to inject malicious scripts into the application's database, which are then executed when the settings page is viewed.

View analysis