Simply Schedule Appointments CVE-2026-94673

No special conditions - remote unauthenticated exploitation against default configurations of the Simply Schedule Appointments WordPress plugin at version 1.6.12.31 or earlier, requiring only that the plugin be installed and its public/AJAX/REST endpoints reachable. The exploit needs no authentication (PR:N), no user interaction (UI:N), and low complexity (AC:L). The practical limit on impact is that only confidentiality is affected (C:L) - the attacker can read but not modify or delete data - and exposure is bounded to whatever objects the IDOR-affected endpoint exposes (appointment/booking records), not the full site. Sites on 1.6.12.31 or later are not affected.

This is a genuine but moderate-severity issue best characterized as 'high-CVSS-context-but-low-real-urgency.' The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) is internally consistent: it describes an unauthenticated, network-reachable, low-complexity IDOR (CWE-639) whose only impact is limited confidentiality (C:L) with no integrity or availability effect. All threat-intelligence exploitation signals are absent - no EPSS score is provided, the CVE is not on CISA KEV, and no public POC is referenced (only the Patchstack database advisory). Because it is an appointment-scheduling plugin, the exposed objects are plausibly booking records containing PII (names, emails, appointment times), which explains the C:L rating but keeps overall impact bounded. The signals do not conflict: low technical impact, no evidence of exploitation, and a single vendor source all point to a routine patch-on-schedule item rather than an emergency. Note the 'Authentication Bypass' tag overstates the flaw - CWE-639 is a broken-object-authorization (IDOR) issue, not an authentication bypass. This is the second disclosed access-control flaw in this plugin (a prior CWE-862 broken access control affected <=1.6.12.29), suggesting a pattern of authorization weaknesses in the codebase worth monitoring.

An unauthenticated attacker sends crafted HTTP requests to a public plugin endpoint, incrementing or substituting an object identifier (e.g., an appointment or booking ID) that the plugin fails to validate against the requester's authorization. Because no login is required and complexity is low, the attacker can enumerate identifiers to read appointment records belonging to other users, harvesting limited confidential data such as customer names, contact details, or schedule information. No public exploit code is identified at time of analysis, but the low complexity makes manual enumeration trivial.