Essentially the flaw is an authorization oversight on the appointment‑listing REST endpoint of the Easy Appointments WordPress plugin. The endpoint requires only a capability that every authenticated user possesses, effectively giving any subscriber the ability to retrieve the full list of bookings, with customer names, dates, and status information. This exposure leads to a confidentiality compromise, allowing roaming users to see sensitive booking details. The weakness is a classic information‑disclosure vulnerability caused by insufficient authorization checks.

WordPress sites that deploy Easy Appointments version 3.12.26 or older are affected, as the flaw resides in the appointment‑listing REST endpoints shipped with those releases.

The vulnerability scores a CVSS of 4.3, indicating a moderate risk, and has an EPSS score of less than 1 %, implying a very low exploitation probability as of the latest data. It is not listed in the CISA KEV catalog. An attacker would need to be a legitimate authenticated user with subscriber-level access, which is typically available on many sites, so the impact is limited to data disclosure rather than full system compromise.