CVE-2026-9232CWE-862broken-access-control

CVE-2026-9232

Medium · published September 19, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-09-19T12:16Z
References (8)
https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L115 · [email protected]https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L183 · [email protected]https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.22/src/ajax.php#L2656 · [email protected]https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L115 · [email protected]https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L183 · [email protected]https://plugins.trac.wordpress.org/browser/easy-appointments/tags/3.12.25/src/ajax.php#L2656 · [email protected]https://plugins.trac.wordpress.org/changeset/3595856 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/6b9322d5-afa0-4f38-b5df-2344310f4119?source=cve · [email protected]
EPSS history
Timeline
  • 20 SEP 03:25Z
    EPSS moved — → 0%
    epss
  • 19 SEP 07:43Z
    Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
    cvelistv5