CVE-2026-14226 is an information exposure vulnerability (CWE-200) in the Easy Appointments WordPress plugin through version 3.12.26. The vulnerability exists because one of the appointment-listing REST API endpoints does not enforce sufficient capability checks, allowing any authenticated user, including subscribers, to retrieve sensitive booking information such as customer names, schedules, and statuses. This improper access control leads to unauthorized disclosure of potentially sensitive customer data.

Authenticated users with minimal privileges (subscriber role) can access sensitive booking information of all customers on the site. This exposure could lead to privacy violations and potential misuse of customer data. There is no indication of remote unauthenticated exploitation or code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles that have authenticated access or disable the vulnerable REST endpoint if possible. Monitor vendor channels for updates and apply patches promptly once released.