CVE-2026-9232— Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Quick assessment
Affected
easyappointments Easy Appointments
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 的 Easy Appointments 插件存在敏感信息泄露漏洞，影响所有 3.12.27 及之前的版本。该漏洞通过 函数暴露敏感数据。拥有“贡献者”或更高权限的已认证攻击者可以利用此漏洞，从 表中提取完整的客户数据集，其中包括可识别个人身份的信息，例如姓名、电子邮箱、手机号码、出生日期和居住地址。
Possible ATT&CK Techniques 1 AI
T1212 · Exploitation for Credential Access
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-9232
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
Source: CVE Program / CVE List V5
Vulnerability Description
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| easyappointments | Easy Appointments | 0 ~ 3.12.27 | - |
|
II. Public POCs for CVE-2026-9232
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-9232
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-9232 (1)
Vendor Advisories for CVE-2026-9232 (1)
IV. Related Vulnerabilities
Same product: Easy Appointments
-
CVE-2026-87966
Easy Appointments 4.0 - 4.0.2.1 - Unauthenticated Arbitrary -
CVE-2026-87965
Easy Appointments < 4.0.2.2 - Unauthenticated Appointment Ca -
CVE-2026-81798
WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site S -
CVE-2026-19406
Easy Appointments < 4.0.1 - Contributor+ Sensitive Informati -
CVE-2026-14225
Easy Appointments < 3.12.28 - Contributor+ Shortcode Allowli
Same vendor: easyappointments
-
CVE-2026-8789
Easy Appointments <= 3.12.27 - Missing Authorization to Auth -
CVE-2026-11992
Easy Appointments <= 3.12.27 - Missing Authorization to Auth -
CVE-2026-2262
Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Inf -
CVE-2024-2844
Easy Appointments <= 3.11.18 - Insufficient Authorization -
CVE-2024-2842
Easy Appointments <= 3.11.18 - Authenticated (Contributor+)
Same weakness: CWE-862
-
CVE-2026-9858
Partial Shipment for Woocommerce <= 3.4 - Missing Authorizat -
CVE-2026-9613
Datalogics Ecommerce Delivery <= 2.6.65 - Missing Authorizat -
CVE-2026-9766
Empik for Woocommerce <= 1.5.1 - Missing Authorization to Au -
CVE-2026-18346
TikTok <= 1.4.1 - Missing Authorization to Unauthenticated T -
CVE-2026-1984
Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Autho
V. Comments for CVE-2026-9232
No comments yet