CVE-2026-2262
Published: 18 April 2026
Summary
CVE-2026-2262 is a high-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
The Easy Appointments plugin for WordPress is vulnerable to sensitive information exposure in all versions through 3.12.21. The flaw resides in the /wp-json/wp/v2/eablocks/ea_appointments/ REST API endpoint, which is registered with a permission_callback of __return_true and therefore performs no authentication or authorization checks.
Unauthenticated attackers can send requests to this endpoint and retrieve customer appointment records containing full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing details. The issue is rated CVSS 7.5 with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
References point to the vulnerable code in ea-blocks.php and to the changeset that updated the plugin to version 3.12.22, correcting the permission callback. The EPSS score is currently 0.4999 with an identical peak value.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23577
Vulnerability details
The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.21 via the `/wp-json/wp/v2/eablocks/ea_appointments/` REST API endpoint. This is due to the endpoint being registered with `'permission_callback' => '__return_true'`, which allows…
more
access without any authentication or authorization checks. This makes it possible for unauthenticated attackers to extract sensitive customer appointment data including full names, email addresses, phone numbers, IP addresses, appointment descriptions, and pricing information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a misconfigured public REST API endpoint in a WordPress plugin that bypasses all auth checks, directly enabling remote unauthenticated exploitation of a public-facing web application for sensitive data access.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Explicitly authorizes specific actions performable without identification or authentication, directly preventing unauthenticated access to sensitive appointment data via the REST API endpoint with '__return_true' permission callback.
Enforces approved authorizations for logical access to information and resources, addressing the lack of authentication and authorization checks on the vulnerable '/wp-json/wp/v2/eablocks/ea_appointments/' endpoint.
Employs least privilege to restrict access to only necessary authorized actions, mitigating the unrestricted access granted by the plugin's permission callback misconfiguration exposing customer data.