Simply Schedule Appointments CVE-2026-110381

Requires an authenticated low-privileged account on a WordPress site running Simply Schedule Appointments version up to and including 1.6.12.35; the attacker must reach a plugin endpoint that accepts a user-controlled object key (e.g. appointment/booking ID) and fails to verify ownership (CWE-639 IDOR). Limiting factors: exploitation needs valid credentials (PR:L, so not pre-auth), is confined to the object types the vulnerable endpoint exposes, and yields only partial read/modify access rather than full account or site takeover; no user interaction is required.

This is a moderate, authenticated-user authorization flaw rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3) indicates a network-reachable, low-complexity attack that nonetheless requires PR:L - i.e. a valid low-privileged authenticated account - and yields only Low confidentiality and integrity impact, consistent with an IDOR/broken-object-level-authorization issue (CWE-639). No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit is referenced, so there is no public exploit identified at time of analysis; SSVC-style signals (no confirmed exploitation, impact partial, automatability unclear) point to Track/Attend rather than Act. The main caveat: the input Tag labels this 'Authentication Bypass,' but the CWE-639 classification and the Patchstack reference both describe an Insecure Direct Object Reference (authorization bypass), so treat it as privilege-scoped data access by an already-authenticated user, not a pre-auth login bypass.

An attacker who holds any low-privileged account on a WordPress site running Simply Schedule Appointments manipulates a user-controlled object identifier (e.g. an appointment or record ID) in a plugin request to read or modify appointment data belonging to other users. Because PR:L is required and no user interaction is needed, a logged-in customer or subscriber could enumerate and tamper with other bookings. No public proof-of-concept is referenced at time of analysis.