The Easy Appointments WordPress plugin up to version 3.12.27 fails to perform a per‑request capability or nonce check on a customer‑listing handler, which permits authenticated users with contributor privileges to read the personal data of all stored customers. This omission represents a confidentiality breach (CWE‑200). No code execution or denial‑of‑service scenarios are described, and the impact is limited to data exposure rather than system compromise.

WordPress sites that have the Easy Appointments plugin installed, any version 3.12.27 or earlier. The CNA vendor is listed simply as Easy Appointments, and no additional OEMs or hosting platforms are identified. Users of older releases should verify the installed version against their plugin inventory.

The CVSS base score of 2.7 indicates a low overall risk, largely because the vulnerability requires prior authentication and only affords read‑only access to customer data. The EPSS score, falling below 1 %, further suggests that real‑world exploitation is unlikely at this time. The vulnerability is not present in the CISA KEV catalog. Attackers would need to be authenticated with a contributor role, making internal privilege escalation the primary vector. Consequently, while the potential data exposure could be significant for a specific organization, the overall threat level remains modest.