CVE-2026-9232

Name of the Vulnerable Software and Affected Versions Easy Appointments versions prior to 3.12.28

Description The plugin is subject to sensitive information exposure through the handle customers ajax function. Authenticated attackers with contributor-level access or higher can extract the complete customer dataset from the ea customers table. This data includes personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.

Recommendations Update the plugin to version 3.12.28 or later.