Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14224— Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR

Quick assessment

Affected
Unknown Easy Appointments
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress Easy Appointments是WordPress基金会的一款CMS插件组件。 WordPress Easy Appointments 3.12.26及之前版本存在授权问题漏洞，该漏洞源于未验证预约操作的用户归属，仅依赖共享nonce，导致已认证用户可覆盖其他用户的客户元数据，并将管理员通知发送至攻击者控制的邮箱。

AI Predicted 7.5 Difficulty: Moderate EPSS 0.23% · P14

Affected Version Matrix 1

VendorProduct Version RangeStatus
Unknown Easy Appointments < 3.12.28 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14224

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Easy Appointments < 3.12.28 - Subscriber+ Cross-User Appointment Data Modification via IDOR
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress Easy Appointments 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress Easy Appointments是WordPress基金会的一款CMS插件组件。 WordPress Easy Appointments 3.12.26及之前版本存在授权问题漏洞，该漏洞源于未验证预约操作的用户归属，仅依赖共享nonce，导致已认证用户可覆盖其他用户的客户元数据，并将管理员通知发送至攻击者控制的邮箱。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unknown Easy Appointments 0 ~ 3.12.28 -

II. Public POCs for CVE-2026-14224

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14224

请登录查看更多情报信息。

Security Blog Posts for CVE-2026-14224 (1)

Same Patch Batch · Unknown · 2026-07-29 · 9 CVEs total

CVE-2026-11351 ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosur
CVE-2026-11974 Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download
CVE-2026-13605 Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute
CVE-2026-13423 Streamit < 4.5.2 - Unauthenticated Remote Code Execution via Arbitrary Function Call
CVE-2026-14234 WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF
CVE-2026-14300 miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover
CVE-2026-13690 UsersWP < 1.2.67 - Two-Factor Authentication Bypass
CVE-2026-13692 PayU CommercePro < 3.9.0 - Unauthenticated Order Tampering

IV. Related Vulnerabilities

Same product: Easy Appointments
Same vendor: Unknown