EUVD-2026-52161
GHSA-7652-g22q-736f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Contributor account (PR:L) required for network access; only confidentiality is impacted as no data modification or denial-of-service is possible.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers' appointment records, including names, email addresses, phone numbers and notes, across the whole site.
AnalysisAI
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment records to any authenticated Contributor-level user site-wide. The administrative appointment-listing shortcode omits a capability check, and the per-user result scoping logic defaults to showing all records when the requesting user is not recognized as staff. Any WordPress user holding the Contributor role or higher - a commonly granted role in multi-author sites - can enumerate names, email addresses, phone numbers, and appointment notes belonging to every customer in the system. A publicly available proof-of-concept exists, though EPSS at 0.13% and SSVC Automatable:No suggest exploitation remains targeted rather than widespread.
Technical ContextAI
The affected product is a WordPress scheduling plugin (CPE: cpe:2.3:a:unknown:simply_schedule_appointments:*:*:*:*:*:*:*:*) designed to manage bookings and customer appointments. The vulnerability is classified under CWE-863 (Incorrect Authorization), meaning authorization checks are either absent or implemented incorrectly rather than being bypassed through a technical exploit. Specifically, a shortcode intended for administrative listing of appointments does not invoke WordPress's capability-checking API (e.g., current_user_can()) before rendering results, and a secondary per-user scoping mechanism designed to restrict output to a staff member's own appointments 'fails open' - returning all records when it cannot positively identify the user as staff. WordPress shortcodes are embeddable by Contributor-role users and above, making the attack surface accessible to any registered user with at minimum post-drafting privileges.
RemediationAI
The primary remediation is to update Simply Schedule Appointments to version 1.6.12.11 or later, which is the vendor-confirmed fixed release per the WPScan advisory (https://wpscan.com/vulnerability/551554a8-12fb-4eb5-bd24-ae627b58dc3b/). Updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins > Update. As a compensating control prior to patching, site administrators should audit and minimize the number of users holding the Contributor role or above, removing or downgrading any accounts that do not require post-creation capabilities - this reduces the exploitable surface without disabling any site functionality. If removing Contributor accounts is operationally infeasible, temporarily disabling the Simply Schedule Appointments plugin entirely will prevent exploitation at the cost of losing scheduling functionality. Do not rely on restricting access to specific pages, as shortcodes can be embedded in draft posts that never require publication.
More in Simply Schedule Appointments
View allSimply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated us
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user inpu
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject ar
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote a
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauth
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 does not sanitise and escape some of its settings, whic
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today