VulnSocial

CVE-2026-2262Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 3 classified signals
  • Peaked 1d ago at 2 mentions (2026-04-18); latest day: 2
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01122Mentions · 2026-04-18: 2Mentions · 2026-04-21: 2Patch / Workaround · 2026-04-21: 1Technical Details · 2026-04-18: 2Technical Details · 2026-04-21: 104-1804-21
Signal classification2 categories
Disclosure
375.0%
Patch
125.0%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-04-182
Disclosure2
2026-04-212
Disclosure1Patch1
Full discourse4 posts
  • pdnuclei-bot@pdnuclei_bot
    Disclosure

    🚨 CVE-2026-2262 - high 🚨 Easy Appointments <= 3.12.21 - Unauthenticated Sensitive Information Exposure > Easy Appointments WordPress plugin <= 3.12.21 contains a sensitive information exposu... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-2262 @pdnuclei #NucleiTemp...

    Post summary

    The tweet announces CVE‑2026‑2262, a high‑severity unauthenticated sensitive information exposure in Easy Appointments WordPress plugin versions ≤3.12.21, and provides a link for further details.

    00010137
    942 followersView on X
  • CyberWolfGuard@CyberWolfGuard
    Patch

    WORDPRESS PLUGIN ALERT: Technical details and CVEs have been disclosed for several popular plugins. If you are running any of the following, your site is vulnerable: CVE-2026-4801 CVE-2026-2262 CVE-2026-2986 Update all plugins #WordPress #InfoSec #BugBounty #CyberAlert https://t.co/pTlTlOCdrs

    Post summary

    The post announces that several WordPress plugins have disclosed CVEs and urges users to update all plugins to mitigate potential risks.

    0000066
    10 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-2262 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablock… https://www.cve.org/CVERecord?id=CVE-2026-2262

    Post summary

    The tweet announces a sensitive information exposure vulnerability in Easy Appointments WordPress plugin versions up to 3.12.21 via a specific REST API endpoint, but offers no PoC, exploit, patch, or active exploitation evidence.

    00000105
    57.2K followersView on X
  • Kaitan ID Security@KaitanSecurity
    Disclosure

    ⚠️ HIGH — CVE-2026-2262 The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and i… CVSS 7.5 Full analysis → https://sec.kaitan.id/cves/CVE-2026-2262 #WordPress #CyberSecurity #InfoSec

    Post summary

    The tweet announces the discovery of CVE-2026-2262, detailing its vulnerability type and severity with a CVSS score, but it does not provide exploitation tools or patch information.

    000001
    145 followersView on X

Explore more

Back to dashboard