CVE-2026-39513: WordPress Easy Appointments plugin <= 3.12.21 - Broken Access Control vulnerability

Synopsis

An unauthenticated broken access control vulnerability affects the WordPress Easy Appointments plugin at version 3.12.21 and below. The flaw is reachable over the network and requires no credentials, allowing any external attacker to bypass intended access restrictions. Successful exploitation gives an attacker read access to sensitive data exposed by the plugin. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerability is fully unauthenticated.

• Victim interactionNot required

  No user action or social engineering is required; the attacker sends requests directly to the affected endpoint.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, specific memory layout, or environmental setup.

Blast Radius

• An attacker reads data exposed through the plugin's access-controlled endpoints without holding any account on the WordPress site.
• Appointment records, customer details, or other structured data managed by Easy Appointments may be extracted depending on the deployment's configuration.
• No data modification or service disruption is indicated by the CVSS vector; impact is limited to confidentiality loss.