Simply Schedule Appointments EUVD-2026-52161

Exploitation requires a valid WordPress user account with at minimum the Contributor role - this is the critical limiting factor. Unauthenticated visitors cannot exploit this vulnerability. The target site must have the Simply Schedule Appointments plugin installed and activated in a version prior to 1.6.12.11. No special non-default configuration is required beyond the plugin being present; the administrative shortcode is available to Contributors by default once the plugin is active. Exploitation is further limited by the SSVC Automatable:No assessment, meaning mass exploitation without a valid account is not feasible. Sites that do not issue Contributor (or higher) accounts to untrusted users have effectively no practical exposure despite the network-accessible CVSS vector.

The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world risk profile: network-accessible, low complexity, low privilege, and high confidentiality impact with no integrity or availability component. This is primarily a data exposure issue. EPSS at 0.13% (3rd percentile) is very low, indicating statistical models do not expect widespread opportunistic exploitation in the near term. However, SSVC classifies exploitation status as 'poc' with Automatable:No - meaning the publicly available exploit code exists but requires a valid WordPress Contributor account, preventing fully automated mass scanning. The KEV absence is consistent with the low EPSS. The real-world risk is highest for multi-author WordPress sites (blogs, news outlets, agencies) where Contributor accounts are routinely issued to external writers who may be untrusted. The PII involved - appointment details including phone numbers and notes - can be valuable for social engineering, fraud, or regulatory exposure under GDPR/CCPA. This is a genuine priority for any site with active appointment volume, but not a fire-drill for organizations without the plugin installed.

An attacker registers or is granted a Contributor account on a WordPress site running the vulnerable plugin - a common scenario on multi-author publications, client sites, or membership platforms. They embed or directly invoke the administrative appointment-listing shortcode, which executes without a capability check and returns all customer appointment records across the site due to the failing-open scoping logic. A publicly available proof-of-concept script automates the data extraction, producing a dump of customer names, emails, phone numbers, and appointment notes with a single authenticated HTTP request.