What is the CVSS score of CVE-2026-1704?

CVE-2026-1704 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1704?

Organizations using plugin for WordPress is vulnerable to Insecure Direct Object Reference in all should be aware of moderate risk from CVE-2026-1704, a IDOR vulnerability rated CVSS 4.3.

How to fix or mitigate CVE-2026-1704?

Within 30 days: Identify affected systems running plugin for WordPress is vulnerable to Insecure Direct Object and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-1704

EUVD-2026-11754 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-03-13 Wordfence

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11754

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 07:23 nvd

MEDIUM 4.3

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the get_item_permissions_check method granting access to users with the ssa_manage_appointments capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.

AnalysisAI

An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress versions up to 1.6.9.29, allowing authenticated users with the ssa_manage_appointments capability to access appointment records belonging to other staff members without authorization. Attackers can exploit the get_item_permissions_check method to enumerate and view sensitive customer personally identifiable information by manipulating appointment ID parameters. The vulnerability has a CVSS score of 4.3 with low attack complexity and requires only low-level authentication, making it a practical concern for multi-staff WordPress installations.

Technical ContextAI

The vulnerability exists in the WordPress plugin ecosystem, specifically in a scheduling application that manages appointment data through REST API endpoints protected by capability checks. The root cause is classified under CWE-639 (Authorization Bypass Through User-Controlled Key), where the permission validation mechanism fails to verify that an authenticated user actually owns or manages the specific appointment record they are attempting to access. The plugin grants the ssa_manage_appointments capability to Team Members and custom-level users, but the get_item_permissions_check method only validates the presence of this capability rather than cross-referencing staff ownership of individual appointment records. This is a common authorization flaw in WordPress plugins where role-based access control is implemented without resource-level ownership validation, allowing horizontal privilege escalation between users at the same capability level.

RemediationAI

Immediately upgrade the Appointment Booking Calendar — Simply Schedule Appointments plugin to a version released after 1.6.9.29, which should include authorization checks that validate staff ownership of requested appointment records. Access the WordPress dashboard, navigate to Plugins, and check for available updates; apply the patch without delay. As a temporary mitigation if patching cannot be applied immediately, restrict the ssa_manage_appointments capability to only essential staff members, disable REST API access for unauthenticated users, and audit appointment access logs for unauthorized queries using your WordPress audit logging plugin. Additionally, consider implementing a Web Application Firewall (WAF) rule to detect and block rapid REST API requests targeting sequential appointment IDs (a pattern indicating IDOR enumeration). After patching, conduct a user access audit to identify any accounts with the ssa_manage_appointments capability that should not have it, and review appointment access logs for signs of prior exploitation.