CVE-2026-14224 is an authorization bypass vulnerability in the Easy Appointments WordPress plugin prior to version 3.12.28. The plugin's customer-data update action fails to verify ownership of the targeted appointment, relying only on a shared nonce accessible to any authenticated user with their own appointment. This allows a subscriber-level user to reuse the nonce to modify another user's appointment metadata (email, name, phone, description). Consequently, when an administrator changes the status of the victim's appointment with customer notifications enabled, the notification is sent to the attacker-controlled email address.

An authenticated subscriber-level user can overwrite customer metadata of other users' appointments, potentially redirecting appointment notifications to attacker-controlled email addresses. This compromises the confidentiality and integrity of appointment contact data but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user permissions or disable customer notifications on status changes to reduce risk.