Cyber Resilience

CVE-2026-2262

High

Published: 18 April 2026

Published
18 April 2026
Modified
22 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.4999 97.9th percentile
Risk Priority 45 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2262 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).

Deeper analysis

The Easy Appointments plugin for WordPress is vulnerable to sensitive information exposure in all versions through 3.12.21. The flaw resides in the /wp-json/wp/v2/eablocks/ea_appointments/ REST API endpoint, which is registered with a permission_callback of __return_true and therefore performs no authentication or authorization checks.

Unauthenticated attackers can send requests to this endpoint and retrieve customer appointment records containing full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing details. The issue is rated CVSS 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

References point to the vulnerable code in ea-blocks.php and to the changeset that updated the plugin to version 3.12.22, correcting the permission callback. The EPSS score is currently 0.4999 with an identical peak value.

EU & UK References

Vulnerability details

The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows…

more

access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The CVE describes a misconfigured public REST API endpoint in a WordPress plugin that bypasses all auth checks, directly enabling remote unauthenticated exploitation of a public-facing web application for sensitive data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2024-13796Shared CWE-200
CVE-2025-25975Shared CWE-200
CVE-2024-12142Shared CWE-200
CVE-2025-25951Shared CWE-200
CVE-2026-34297Shared CWE-200
CVE-2024-26480Shared CWE-200
CVE-2026-24498Shared CWE-200
CVE-2025-22828Shared CWE-200
CVE-2026-23659Shared CWE-200
CVE-2024-11282Shared CWE-200

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Explicitly authorizes specific actions performable without identification or authentication, directly preventing unauthenticated access to sensitive appointment data via the REST API endpoint with '__return_true' permission callback.

prevent

Enforces approved authorizations for logical access to information and resources, addressing the lack of authentication and authorization checks on the vulnerable '/wp-json/wp/v2/eablocks/ea_appointments/' endpoint.

prevent

Employs least privilege to restrict access to only necessary authorized actions, mitigating the unrestricted access granted by the plugin's permission callback misconfiguration exposing customer data.

References