Appointment Booking Calendar Simply Schedule Appointments Booking Plugin CVE-2026-1704

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates this is a low-impact but easily exploitable vulnerability: network-accessible, low attack complexity, requiring only low-level authentication (PR:L), with no user interaction required. The confidentiality impact is rated low (C:L) because exposure is limited to appointment data, though this data contains personally identifiable information (PII) of customers. The integrity and availability impacts are none (I:N/A:N), reducing overall severity. However, real-world risk is materially higher than the CVSS 4.3 score suggests because the vulnerability operates in a multi-tenant context where staff members often have legitimate system access, making detection difficult; PII exposure has regulatory implications under GDPR and similar privacy regulations; and the attack is trivially automatable via REST API enumeration without user interaction. The lack of integrity impact and moderate access requirements prevent this from being rated as critical, but EPSS and KEV data would be essential to assess actual exploitation prevalence in the wild. For organizations operating appointment booking systems with sensitive customer data, this vulnerability warrants prompt patching despite the moderate CVSS score.

A Team Member at a medical clinic using the plugin for patient appointment scheduling could craft a simple request to the REST API endpoint like GET /wp-json/ssa/v1/appointments/123?param=value, incrementing the appointment ID to view appointments belonging to other clinic staff members. Since the attack requires only network access and low-level authentication (which the attacker already possesses as an employee), and the API requires no user interaction, the attacker can systematically enumerate all appointments in the system and extract patient names, phone numbers, email addresses, and appointment details. Within minutes, the attacker could export hundreds of customer records without triggering alerts, as the requests appear to come from an authenticated, authorized user accessing their normal system functionality.