The Easy Appointments plugin for WordPress contains a sensitive information exposure vulnerability (CWE-200) in all versions up to and including 3.12.21. The issue arises because the REST API endpoint `/wp-json/wp/v2/eablocks/ea_appointments/` is registered with `'permission_callback' => '__return_true'`, effectively disabling any authentication or authorization checks. This allows unauthenticated attackers to retrieve sensitive customer appointment data such as full names, emails, phone numbers, IP addresses, appointment details, and pricing. The CVSS 3.1 base score is 7.5, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, and no user interaction needed. There is no vendor advisory or patch information available at this time.

An unauthenticated attacker can access sensitive customer information including personally identifiable information and appointment details without any authentication. This exposure can lead to privacy violations and potential misuse of customer data. The integrity and availability of the system are not affected by this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST API endpoint if possible, such as by implementing custom authentication or limiting access via firewall rules. Monitor for updates from the Easy Appointments vendor and apply official patches once released.