Simply Schedule Appointments EUVD-2026-59859

Stage one requires a valid WordPress account with at minimum Contributor-level privileges - specifically any account possessing the edit_posts capability. The /wp-json/ssa/v1/render-shortcode endpoint is active on every WordPress installation running the plugin, regardless of whether the Divi theme is installed or active. The attacker must supply arbitrary appointment IDs in the ssa_past_appointments parameter to trigger the IDOR; no special server configuration, plugin setting, or feature flag is needed beyond the plugin being installed and active. Stage two - reading or modifying appointments using harvested tokens - imposes no authentication requirement at all; any HTTP client with a valid token can perform these operations. Exploitation is bounded by: (1) the plugin being active on the target site, (2) the site running version 1.6.12.10 or earlier, and (3) the attacker possessing or having compromised a Contributor-or-higher WordPress account for the initial token-harvest step.

The official CVSS score of 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N materially understates real-world risk because it records I:N - yet the CVE description explicitly states that harvested tokens can be used to modify appointments, not merely read them, making I:H the more accurate metric and pushing the effective base score closer to 8.0. EPSS data was not provided in the available intelligence, and the vulnerability is absent from the CISA KEV at time of analysis, indicating no confirmed widespread active exploitation. However, the PR:L constraint applies only to the token-harvest stage; the second stage is fully unauthenticated, meaning the privilege requirement is effectively bypassed for the highest-impact action. Attack complexity is genuinely low - the endpoint URL and parameter name are disclosed in the CVE description, and the referenced source code is publicly browsable in the WordPress plugin repository. Even a mid-sized municipal IT team in kalisz running appointment booking for constituent services should treat this as urgent given the combination of full PII exposure and unauthenticated write access in stage two. Risk is concentrated in deployments where Contributor accounts are granted to external parties, multi-author publishing environments, or any WordPress site where account registration is open.

An attacker who holds or has obtained a WordPress Contributor account on a target site sends repeated POST requests to /wp-json/ssa/v1/render-shortcode with sequentially or randomly varied ssa_past_appointments values, collecting 32-character ownership tokens from the HTML embedded in each response. The attacker then uses those tokens - without any further authentication - to call the appointment management API and bulk-exfiltrate customer records including names, email addresses, phone numbers, and private booking notes, or to silently modify upcoming appointments. No public exploit code has been identified, but the attack is constructible directly from the CVE description and the publicly browsable plugin source code.