Description

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-19T08:16:55.053Z",
  "pubdate": "2026-09-19T08:16:55.053Z",
  "executiveSummary": "The Easy Appointments plugin for WordPress, in versions up to and including 3.12.27, is susceptible to an improper access control vulnerability leading to Sensitive Information Exposure.\nThe flaw resides within the handle_customers_ajax function, which fails to adequately validate the authorization level of the requesting user.\nSuccessful exploitation allows an authenticated attacker possessing contributor-level privileges or higher to perform unauthorized database queries against the ea_customers table.\nThe impact includes the wholesale exfiltration of Personally Identifiable Information (PII), encompassing names, email addresses, mobile numbers, dates of birth, and physical addresses of customers.\nThis vulnerability poses a significant risk to data privacy and regulatory compliance, as it bypasses intended access restrictions to expose sensitive user records.\nExploitation requires the attacker to have at least a contributor account on the WordPress installation, limiting the vector to authenticated users, yet posing a severe threat due to the extent of data exposure.",
  "technicalDetails": "The vulnerability is rooted in an insecure implementation of the handle_customers_ajax function within the Easy Appointments plugin. The function is designed to handle AJAX requests related to customer data management but lacks sufficient capability checks to ensure that the requester is authorized to view or retrieve the full customer dataset.\nThe primary component affected is the AJAX handler responsible for querying the ea_customers database table. Because the plugin does not enforce strict user role verification before processing the request, the application treats incoming requests from low-privileged users (e.g., contributors) as legitimate, provided the user has a valid authentication session.\nThe attack flow proceeds as follows: 1. An attacker authenticates as a user with contributor or higher privileges within the WordPress environment. 2. The attacker triggers a crafted AJAX request targeting the vulnerable handle_customers_ajax endpoint. 3. The server-side logic processes the request without validating whether the current user session has the administrative permissions required to access customer data. 4. The underlying database query executes against the ea_customers table. 5. The plugin returns the full dataset—including sensitive PII such as full names, email addresses, phone numbers, and home addresses—directly in the response body. 6. The attacker parses the returned JSON or serialized data to aggregate the entire customer database.\nThis vulnerability is classified as an improper access control issue, specifically failing to maintain the principle of least privilege. The exposure is total, meaning that a single authenticated request can facilitate the exfiltration of the entire customer repository associated with the plugin. Given the sensitive nature of the data stored in the ea_customers table, the post-exploitation impact is high, resulting in potential large-scale privacy breaches, identity theft risks, and non-compliance with data protection regulations such as GDPR or CCPA.\nAffected versions include all releases up to and including 3.12.27. As the handler is exposed via the standard WordPress AJAX action API, it is reachable as long as the plugin is active and the attacker maintains a valid contributor session on the affected WordPress site. There is no requirement for specific server-side misconfigurations; the flaw is intrinsic to the plugin code."
}