CVE-2026-14224

Name of the Vulnerable Software and Affected Versions Easy Appointments WordPress plugin versions prior to 3.12.27

Description The plugin fails to verify if the appointment being updated via the customer-data update action belongs to the authenticated user. It relies on a shared nonce (a unique token used to prevent cross-site request forgery) that any authenticated user can obtain from their own appointment edit form. Consequently, a user with subscriber-level privileges can reuse this nonce to overwrite the customer metadata of another user's appointment, specifically the email, name, phone, and description variables. If an administrator subsequently changes the appointment status while customer notifications are enabled, the notification intended for the victim is sent to the attacker's email address.

Recommendations Update Easy Appointments WordPress plugin to version 3.12.27 or later.