WordPress Plugin Exposes Sensitive Customer Data

The National Vulnerability Database (NVD) has reported a critical sensitive information exposure vulnerability, CVE-2026-2262, affecting the Easy Appointments plugin for WordPress. All versions up to and including 3.12.21 are impacted. The NVD highlights that the /wp-json/wp/v2/eablocks/ea_appointments/ REST API endpoint is improperly configured with __return_true for its permission callback, effectively bypassing all authentication and authorization.

This misconfiguration allows any unauthenticated attacker to access a trove of sensitive customer appointment data. According to the NVD, this includes full names, email addresses, phone numbers, IP addresses, detailed appointment descriptions, and even pricing information. The CVSS score of 7.5 (HIGH) underscores the severity of this exposure, with a vector indicating network-exploitable, low complexity, no privileges required, and high confidentiality impact.

For defenders, this is a clear call to action. An attacker’s calculus here is simple: low effort for high reward. They can scrape vast amounts of PII without needing to authenticate. If your organization uses the Easy Appointments plugin, you’re sitting on a data leak waiting to happen. Patch immediately and review your data exposure policies, especially for third-party integrations.