What is the CVSS score of CVE-2026-13358?

CVE-2026-13358 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Simply Schedule Appointments CVE-2026-13358

EUVD-2026-59859 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-16 Wordfence

GHSA-w9gm-5x7r-8v42

WordPress Authentication Bypass Simply Schedule Appointments Wordpress Plugin Croixhaug

6.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

8.1 HIGH

Official vector omits integrity impact; CVE description explicitly confirms harvested tokens enable appointment modification, warranting I:H alongside C:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 16, 2026 - 05:08 vuln.today

CVE Published

Aug 16, 2026 - 04:24 cve.org

MEDIUM 6.5

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain.

AnalysisAI

Insecure Direct Object Reference in the Simply Schedule Appointments WordPress plugin (all versions ≤ 1.6.12.10) enables any authenticated Contributor-level user to enumerate appointment records belonging to arbitrary customers and extract 32-character per-appointment ownership tokens from server-rendered HTML. Those harvested tokens then grant fully unauthenticated read and write access to any appointment - exposing and permitting modification of full customer PII including names, email addresses, phone numbers, and private notes. No public exploit code has been identified at time of analysis and the vulnerability does not appear in the CISA KEV, but the two-stage attack is mechanically straightforward and is confirmed by Wordfence with direct source-code line references.

Technical ContextAI

The vulnerability resides in the WordPress REST API endpoint /wp-json/ssa/v1/render-shortcode, implemented in class-shortcodes.php (line 781). As confirmed by the referenced source at class-divi.php lines 237 and 254, this endpoint is registered unconditionally on rest_api_init - not gated on any theme or feature flag - and its permission callback enforces only current_user_can('edit_posts'), a capability held by every Contributor-level account. The ssa_past_appointments parameter is passed to the database layer (class-db-model.php line 325 and class-appointment-model.php line 1936) without validating that the requesting user owns the referenced records, which is the textbook CWE-639 pattern: authorization is decided by a user-controlled key rather than by verified ownership. The per-appointment 32-character hash tokens are embedded in the rendered HTML response and subsequently accepted by the appointment management API with no further identity check, creating a second-stage unauthenticated access path. CPE cpe:2.3:a:croixhaug:simply_schedule_appointments:*:*:*:*:*:*:*:* identifies the affected product across all versions in the wildcard range.

RemediationAI

A fix commit has been submitted to the Simply Schedule Appointments plugin repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3617759%40simply-schedule-appointments&new=3617759%40simply-schedule-appointments), but a specific patched release version number is not confirmed in the available data - administrators should verify the current version in the WordPress.org plugin directory and update to any release newer than 1.6.12.10 as soon as a patched build is published. As an immediate compensating control, restrict or audit all Contributor-level WordPress accounts, removing any that belong to untrusted or external parties, since Contributor access is the sole prerequisite for the token-harvest stage. A WAF rule or REST API restriction plugin can be configured to block POST requests to /wp-json/ssa/v1/render-shortcode from non-administrative roles; note this will disable shortcode rendering functionality for the plugin until a patch is applied. Site owners running Divi-themed installations should not assume they are uniquely at risk - the endpoint is registered unconditionally regardless of active theme.