Simply Schedule Appointments EUVD-2026-90464

No special conditions - remote unauthenticated exploitation against default configurations of the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.32). Exploitation specifically requires sending the 'recursive' parameter to the affected appointment/REST endpoint; the secondary deletion step requires the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts a leaked per-appointment public_token as sole authorization. The only limiting factor is that the target site must run the plugin at a vulnerable version; no authentication, user interaction, or non-default setting is needed.

This is a genuinely high-priority flaw despite the absence of exploitation telemetry. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is confirmed by the fully unauthenticated, network-reachable, low-complexity nature of the bug: a single crafted request abusing the 'recursive' parameter dumps customer PII and per-appointment public_token values, with no auth, no user interaction, and against default installs. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation status is 'no public exploit identified at time of analysis' - but WordPress plugin information-disclosure bugs of this class are historically automated at scale once a Wordfence advisory and patch diff are public, and the referenced trac changeset (3709365) gives attackers a ready-made before/after to reverse. The vendor's vector scores only C:H (I:N/A:N), which UNDERSTATES real impact: the description explicitly states the leaked public_token values let an unauthenticated attacker delete arbitrary appointments via DELETE /wp-json/ssa/v1/appointments/{id}, which is an integrity impact the base vector omits. Net: treat as a real, prioritize-now issue (confidentiality breach of regulated PII plus a destructive secondary action), not a high-CVSS-but-low-risk paper cut.

An unauthenticated attacker sends a crafted REST request to a vulnerable Simply Schedule Appointments endpoint abusing the 'recursive' parameter, causing the API to return appointment records including customer names, emails, phone numbers, custom form fields, and each appointment's public_token. The attacker then replays each leaked token against DELETE /wp-json/ssa/v1/appointments/{id} - which accepts the token as sole authorization - to wipe arbitrary appointments. No public exploit code was identified in the provided data, but the vendor advisory and patch changeset make the flaw trivially reproducible.