Undefined · Undefined · CVE-2026-14221
**Name of the Vulnerable Software and Affected Versions**
Easy Appointments WordPress plugin versions prior to 4.1
**Description**
Several appointment-management actions fail to perform capability checks, relying solely on a nonce that any authenticated user can obtain. This allows users with contributor-level access to read all customer appointment details and to create, modify, or delete bookings.
**Recommendations**
Update the plugin to a version later than 4.0.