A critical vulnerability in the Easy Appointments WordPress plugin allows unauthenticated attackers to exfiltrate sensitive customer data including names, emails, and phone numbers.

The plugin registers the REST API endpoint at /wp-json/wp/v2/eablocks/ea_appointments/ with a permission callback set to return true, which permits unauthenticated users to bypass all authorization checks. This flaw allows external attackers to query the endpoint and retrieve private appointment records without requiring any login credentials.

This vulnerability poses a significant risk to data privacy and regulatory compliance. Successful exploitation results in the unauthorized disclosure of personally identifiable information (PII) for customers, which can lead to reputational damage, loss of client trust, and potential legal or financial penalties under privacy regulations. Given the CVSS score of 7.5, the risk is classified as High due to the ease of exploitation and the sensitivity of the exposed data.

Immediate Action: Update the Easy Appointments plugin to version 3.12.22 or later immediately to apply the required authorization checks.

Proactive Monitoring: Review web server access logs for anomalous, high-frequency requests directed at the /wp-json/wp/v2/eablocks/ea_appointments/ endpoint.

Compensating Controls: If immediate patching is not feasible, implement a Web Application Firewall (WAF) rule to block unauthorized traffic to the identified REST API endpoint.

Public Exploit Available: No (A Nuclei detection template exists, but there is no evidence of a functional public exploit or weaponized module).

Organizations utilizing the Easy Appointments plugin must prioritize this update to prevent the unauthorized exposure of customer data. Given that the vulnerability is easily weaponized via automated scripts, administrators should ensure the patch is applied immediately across all affected production environments to maintain data integrity and security posture.