The Easy Appointments WordPress plugin can expose sensitive customer data such as names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing. The vulnerability is caused by a REST API endpoint whose permission callback is set to '__return_true', meaning that the endpoint does not perform any authentication or authorization checks. This flaw allows unauthenticated actors to retrieve unfiltered appointment records via the /wp-json/wp/v2/eablocks/ea_appointments/ URL.

All installations of the Easy Appointments plugin with version 3.12.21 or earlier are affected. The vulnerability exists in every build up to and including 3.12.21 and does not impact later releases.

With a CVSS score of 7.5, the flaw presents a moderate to high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, but the lack of authentication and the public nature of the REST endpoint make exploitation easy for attackers who do not possess credentials. An attacker can perform straightforward GET requests to the endpoint and obtain sensitive personal and transaction data, potentially leading to privacy violations and data breach risks.