Easy Appointments <=3.12.27 Sensitive Info Exposed via handle_customers_ajax
CVE-2026-9232 Published on September 19, 2026
Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_customers_ajax. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full customer dataset from the ea_customers table, including personally identifiable information such as names, email addresses, mobile numbers, dates of birth, and physical addresses.
Timeline
Disclosed
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-9232 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-9232
Want to know whenever a new CVE is published for Easyappointments? stack.watch will email you.
Affected Versions
easyappointments Easy Appointments:- Before and including 3.12.27 is affected.