What the vulnerability does
01Description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.11.8 due to the plugin not properly verifying that a user is authorized to perform an action via the bulk appointments REST API endpoint. This makes it possible for unauthenticated attackers to modify arbitrary appointment records including customer PII, payment status, and meeting URL fields, and to expose full customer PII from existing appointment records via the bulk endpoint response. The public nonce is a static, user-independent value present in the HTML source of any page hosting the [ssa_booking] shortcode, meaning any visitor who has viewed such a page can obtain it and target any appointment in the system without authentication.
Explanation of Vulnerability in Simple Terms
02Summary
The Simply Schedule Appointments Booking Plugin for WordPress does not properly check user permissions before allowing certain actions. An attacker without authentication can modify appointment data or settings through direct requests. This affects all versions up to 1.6.11.8. Site administrators should update to a version newer than 1.6.11.8 as soon as it becomes available.
What an attacker can do
03Attacker Capabilities
Modify appointment data or plugin settings without logging in.
Potential impact on your site
04Site Impact
Appointment bookings and plugin configuration can be altered by unauthorized visitors, disrupting scheduling and potentially exposing customer data.
Conditions required to exploit
05Prerequisites
Network access to the WordPress site; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 28, 2026
CVE published
May 28, 2026
Record updated
