Easy Appointments vulnerabilities

The Easy Appointments plugin versions 3.12.27 and earlier are vulnerable to unauthenticated Insecure Direct Object References (IDOR).

In Easy!Appointments version 1.5.2, an Excessive Data Exposure vulnerability in the customers search endpoint allows an authenticated user to obtain appointment hashes belonging to other users.

A vulnerability in Easy!Appointments prior to version 1.6.0 allows any logged-in backend user (admin, provider, secretary) to hijack another provider's Google sync. The attacker can replace the OAuth token, causing customer data (name, email) to be sent to their own Google calendar.

A stored XSS vulnerability in Easy!Appointments allows an administrator to inject malicious HTML/JavaScript into the booking disabled message field. This content is displayed unsanitized on the public booking page, affecting every unauthenticated visitor.

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointment ids with a self-asserted manage_mode flag to rewrite appointment details, rebind them to attacker-controlled customers, and obtain management hashes for rescheduling or cancellation.

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 3.12.27 via the handle_customers_ajax. This allows authenticated attackers with contributor-level access and above to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpoint before updating an existing appointment identified by a request-supplied id, allowing unauthenticated attackers to overwrite, and through a follow-on cleanup delete, arbitrary appointments.

The Easy Appointments WordPress plugin before 4.0.2.2 does not use an unguessable token to authorize its mail-link appointment cancellation and confirmation action, deriving the token from a hardcoded source-embedded salt and the appointment's creation timestamp, so unauthenticated attackers who know or guess that timestamp can cancel or confirm arbitrary appointments.

DOM-Based Cross Site Scripting (XSS) vulnerability in Easy Appointments versions up to 4.0.2.1. Allows an attacker to manipulate the DOM of the page in the victim's browser, leading to execution of malicious script.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 incorrectly validates shortcode input, allowing contributor-level users to execute arbitrary registered shortcodes.

The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks capability and nonce checks in a connection-deletion action, allowing contributor-level users to delete booking configuration and disable the booking system.

A vulnerability in the Easy Appointments WordPress plugin through 4.0 lacks capability checks in appointment-management actions, relying only on a nonce, allowing contributor-level users to read all customers' appointment details and to create, modify, and delete bookings.

A vulnerability in the Easy Appointments WordPress plugin before 3.12.28 lacks per-request capability and nonce checks on a customer-listing handler, allowing authenticated contributor-level users to read all stored customers' personal information.

The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the plugin then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.

The Easy Appointments plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to and including 3.12.27.

SSRF vulnerability in Easy!Appointments allows authenticated backend users to access loopback, RFC1918, and link-local hosts on the deployment network. Lack of scheme and host validation in the `caldav_url` parameter enables attackers to send REPORT requests to arbitrary addresses, with partial response disclosure in JSON messages.

A vulnerability in Easy!Appointments before version 1.6.0 allows an authenticated provider to inject appointments into another provider's schedule. The `appointments/store` and `appointments/update` endpoints do not verify that the provider ID belongs to the current session, breaking provider isolation. Additionally, the `store` path has a write-before-crash bug that persists unauthorized data in the database.

Easy!Appointments up to version 1.5.2 embeds the entire customer record as inline JavaScript on the reschedule page without authentication or field whitelisting. Anyone with the 12-character appointment hash can read all columns of the customer record from the ea_users table.

The Easy Appointments plugin for WordPress up to version 3.12.27 is vulnerable to authorization bypass. Authenticated attackers with author-level access can cancel all future appointments site-wide by marking them as abandoned. The nonce for the cancellation request is exposed on the Appointments admin page, which is only gated by the edit_posts capability, making it accessible to low-privileged users.

Versions of Easy Appointments up to 3.12.21 have an unauthenticated broken access control vulnerability that may allow attackers to access resources they should not have access to.

A SQL injection vulnerability was discovered in Easy!Appointments version 1.5.1 via the order_by parameter. An attacker can manipulate this parameter to execute unauthorized database queries.