Technical impact
The Easy Appointments WordPress plugin can expose sensitive customer data such as full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing. The vulnerability is caused by a REST API endpoint whose permission callback is set to '__return_true', meaning that the endpoint does not perform any authentication or authorization checks. This is a CWE-200 Sensitive Information Exposure flaw that allows unauthenticated actors to retrieve unfiltered appointment records via the /wp-json/wp/v2/eablocks/ea_appointments/ URL.
Affected Systems
All installations of the Easy Appointments plugin with version 3.12.21 or earlier are affected. The vulnerability exists in every build up to and including 3.12.21 and does not impact later releases.
Risk and Exploitability
With a CVSS score of 7.5, the flaw presents a moderate to high severity. The EPSS score is 2%, and the issue is not listed in the CISA KEV catalog, but the lack of authentication and the public nature of the REST endpoint make exploitation easy for attackers who do not possess credentials. Based on the description, it is inferred that attackers can perform straightforward GET requests to the /wp-json/wp/v2/eablocks/ea_appointments/ endpoint and obtain sensitive personal and transaction data, potentially leading to privacy violations and data breach risks.
