Simply Schedule Appointments CVE-2026-91109

Requires an authenticated WordPress account at subscriber level or above (PR:L) AND possession of a valid id_token for at least one appointment within the targeted group booking - the explicit prerequisite stated in the description. Exploitation is otherwise remote, network-based, needs no user interaction, and works against the plugin's normal group-booking flow in Simply Schedule Appointments ≤1.6.12.31 via the 'complete_group' REST parameter. Limiting factors: the attacker must hold a group id_token, and impact is confined to co-bookers sharing that group booking, so exposure scales with how widely group bookings are used rather than being an open unauthenticated scan.

Signals point to a genuine but access-gated data-exposure and tampering flaw rather than a mass-exploitation priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) reflects easy network exploitation but requires authentication at subscriber level and above (PR:L) plus possession of a valid id_token for one appointment in the targeted group booking. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - not active or weaponized. The most important conflict is that Wordfence scored this confidentiality-only (C:H/I:N/A:N), but the description explicitly states the leaked tokens let the attacker 'read, overwrite arbitrary appointment meta on, or cancel' co-bookers' appointments - that is clear integrity and availability impact the vendor vector omits, so the real impact is understated (independently assessed closer to C:H/I:H/A:L). The id_token prerequisite further limits scope to co-bookers within a shared group booking, making this targeted rather than broadly scannable.

An attacker registers or already holds a subscriber-level WordPress account and makes a legitimate group booking (or otherwise obtains one valid appointment id_token). They then call the REST controller with a manipulated 'complete_group' parameter to enumerate every co-booker's private id_token (returned as public_token) along with their name and email, and reuse each leaked token to read, overwrite appointment metadata, or cancel other people's appointments. No public proof-of-concept was provided, but the attack requires only low privileges and no user interaction.