CVE-2026-14223 is an authorization bypass vulnerability (CWE-639) in the Easy Appointments WordPress plugin before version 3.12.28. The plugin fails to verify that a user requesting stored customer details owns or has the capability to access that data. As a result, authenticated users with subscriber-level privileges can enumerate identifiers to access personal information of other customers. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, and impacts confidentiality only.

An attacker with subscriber-level access can read personal information of any customer stored by the plugin. This leads to unauthorized disclosure of sensitive customer data. There is no impact on data integrity or availability. The vulnerability could lead to privacy violations and potential compliance issues depending on the data involved.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to customer data access.