The Easy Appointments WordPress plugin fails to restrict one of its REST endpoints that lists appointment records. Contributors – users with a contributor role – can therefore request the entire list of bookings and receive sensitive data such as customer names, schedules, and statuses. This constitutes a confidentiality breach described by CWE‑200 and allows a user with only contributor‑level authentication to access data they should not see.

The vulnerability affects any WordPress site that has the Easy Appointments plugin installed in a version earlier than 4.0.1. All contributor users on such installations are at risk, regardless of how many bookings exist on the site.

The CVSS score of 2.7 indicates low severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by authenticating as a contributor and sending a request to the unsecured REST endpoint; no elevated privileges or additional access are required. The outcome is the disclosure of all appointment records on the affected site.