The Easy Appointments WordPress plugin through version 3.12.26 contains an insecure direct object reference that allows a subscriber to overwrite the customer metadata of another user’s appointment. The plugin only checks a nonce that any authenticated user can obtain from their own appointment edit form, but it does not confirm that the appointment belongs to the user making the request. As the plugin treats the overwritten fields as the appointment’s contact data, a subsequent administrator‑initiated status change that triggers notifications will deliver the victim’s appointment message to the attacker‑controlled email address, enabling impersonation or phishing.

All installations of the Easy Appointments WordPress plugin up to and including version 3.12.27 are vulnerable. Sites that allow subscriber‑level users to create or edit appointments can be exploited. The flaw exists wherever the vulnerable plugin version is deployed, regardless of additional site configuration.

The CVSS score of 5.4 indicates moderate severity, and the EPSS score of less than 1 % suggests a low likelihood of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must be a legitimate authenticated subscriber and must know or guess the victim’s appointment ID. No elevated privileges are required to execute the attack, making it a moderate threat for targeted subscribers who can access another user’s appointment data.