Description

The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, allowing users with contributor-level access to read all bookings on the site, including customer names, schedules, and statuses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-19T06:17:39.580Z",
  "pubdate": "2026-08-19T06:17:39.580Z",
  "executiveSummary": "An access control vulnerability has been identified in the Easy Appointments WordPress plugin prior to version 4.0.1. The flaw resides in an appointment-listing REST API endpoint, which fails to enforce proper authorization checks to restrict retrieved records to those belonging to the authenticated session or requesting user. Consequently, authenticated users possessing low-privilege contributor-level access can arbitrarily query and retrieve all booking records across the target WordPress deployment. The business impact of this vulnerability includes the unauthorized disclosure of sensitive personally identifiable information (PII), such as customer names, alongside operational schedules and individual booking statuses. This creates significant privacy and compliance risks for site operators. The attacker capability is bounded by the requirement of authenticated low-privilege access, meaning an adversary must first provision or compromise a contributor-level account on the WordPress instance to interact with the vulnerable REST endpoint. No complex exploit chains or advanced payload execution are required to achieve unauthorized data exfiltration, as direct HTTP requests to the misconfigured endpoint yield the complete dataset in JSON or serialized formats.",
  "technicalDetails": "The vulnerability is fundamentally rooted in a broken object level authorization (BOLA) or missing function level access control flaw within the REST API architecture of the Easy Appointments plugin. Specifically, the vulnerable component comprises one of the plugin appointment-listing REST endpoints, which is exposed to handle queries regarding booking records. The root cause of the vulnerability stems from the absence of contextual ownership verification and role-based validation routines within the controller or callback functions governing the endpoint. Instead of validating whether the requesting user possesses administrative privileges or ownership credentials tied directly to the requested records, the endpoint blindly processes database queries and returns comprehensive booking datasets.\nThe exploitation method relies entirely on the abuse of legitimate REST API routing exposed by the WordPress application. The attack flow initiates when an adversary authenticates to the WordPress instance with contributor-level privileges. Leveraging this valid session cookie or application password, the attacker crafts an HTTP GET or POST request targeting the vulnerable appointment-listing REST endpoint. Because the application fails to restrict query results based on the current user context or verify the caller authorization tier, the underlying database handler executes a broad query retrieving all entries from the appointments database table. The server then serializes this comprehensive dataset and returns it in the HTTP response body.\nThe attack surface is exposed over the network via standard HTTP/HTTPS protocols utilized by the WordPress REST API infrastructure. The affected versions encompass all iterations of the Easy Appointments WordPress plugin prior to version 4.0.1. The privilege requirement is strictly limited to authenticated low-privilege access, specifically users assigned the contributor role within WordPress. The post-exploitation impact is characterized by the absolute breach of confidentiality regarding customer interactions. Attackers can systematically harvest customer names, scheduling timestamps, and booking statuses on a continuous basis, facilitating reconnaissance for secondary social engineering attacks, targeted phishing campaigns, or the aggregation of proprietary business intelligence regarding client volume and operational workflows."
}