CVE-2026-14224 is an authorization bypass vulnerability in the Easy Appointments WordPress plugin through version 3.12.26. The plugin's customer-data update action does not verify ownership of the targeted appointment, relying only on a shared nonce accessible to any authenticated user with an appointment. This flaw enables a subscriber-level user to reuse their own nonce to modify the customer metadata (email, name, phone, description) of another user's appointment. Because the plugin uses this metadata for appointment contact data, an administrator-triggered status change with notifications enabled results in appointment notifications being sent to the attacker-controlled email address.

An authenticated subscriber-level user can overwrite another user's appointment contact information, causing appointment notifications to be sent to an attacker-controlled email address. This could lead to unauthorized disclosure of appointment details and potential social engineering or phishing attacks using the redirected notifications.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level user permissions where possible and monitor for suspicious appointment metadata changes. Avoid enabling customer notifications on appointment status changes if feasible.