CVE-2026-14226 is an information exposure vulnerability (CWE-200) in the Easy Appointments WordPress plugin prior to version 3.12.28. The vulnerability exists because one of the plugin's REST API endpoints for listing appointments does not enforce sufficient capability checks. Instead, it restricts access only to a capability that all authenticated users, including those with subscriber-level access, possess. This allows these users to retrieve sensitive booking information such as customer names, appointment schedules, and statuses, which should be protected.

Authenticated users with minimal privileges (subscriber-level) can access sensitive booking information of all customers on the site. This exposure could lead to privacy violations and unauthorized disclosure of personal data. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected REST endpoint by modifying capability requirements or limiting authenticated user roles that can access it.