CVE-2026-55651

The Easy Appointments plugin versions 3.12.27 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR).

A vulnerability in Easy!Appointments prior to version 1.6.0 allows any logged-in backend user (admin, provider, secretary) to hijack another provider's Google sync. The attacker can replace the OAuth token, causing customer data (name, email) to be sent to their own Google calendar.

A stored XSS vulnerability in Easy!Appointments allows an administrator to inject malicious HTML/JavaScript into the booking disabled message field. This content is displayed unsanitized on the public booking page, affecting every unauthenticated visitor.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 incorrectly validates shortcode input, allowing contributor-level users to execute arbitrary registered shortcodes.

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks capability and nonce checks in a connection-deletion action, allowing contributor-level users to delete booking configuration and disable the booking system.

A vulnerability in the Easy Appointments WordPress plugin through 4.0 lacks capability checks in appointment-management actions, relying only on a nonce, allowing contributor-level users to read all customers' appointment details and to create, modify, and delete bookings.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks per-request capability and nonce checks on a customer-listing handler, allowing authenticated contributor-level users to read all stored customers' personal information.

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the plugin then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.