Description
The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Easy Appointments | < 3.12.28 | 3.12.28 |
References
- https://wpscan.com/vulnerability/28b71d3e-5034-42d9-8044-68c90731d38f/ exploit vdb-entry technical-description