CVE-2026-2262

The Easy Appointments plugin for WordPress versions up to 3.12.21 contains a sensitive information exposure vulnerability in the REST API endpoint /wp-json/wp/v2/eablocks/ea_appointments/. The endpoint is improperly configured with unrestricted permissions, allowing unauthenticated attackers to directly access and extract sensitive customer data without any authentication checks. The vulnerability carries a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring low complexity and no user interaction. The impact is limited to confidentiality breach, with attackers able to retrieve full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information. The EPSS score of 0.29 indicates moderate exploitation probability relative to other CVEs. The vulnerability is currently listed on the CISA Known Exploited Vulnerabilities (KEV) Catalog as an active exploitation target, indicating real-world attacks are underway. While the FAUCET Risk Score of 65/100 represents elevated concern, community engagement and exploit availability data suggest this threat warrants immediate patching prioritization by affected organizations.