Simply Schedule Appointments <= 1.6.12.35 - Authenticated (Contributor+) Insecure Direct Object Reference via 'edit' Shortcode Attribute
- ID
- WPSEC-2026-1013
- Plugin
- Simply Schedule Appointments (simply-schedule-appointments)
- Affected
- all versions before 1.6.12.37
- Remediation
- Update to 1.6.12.37 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- Simply Schedule Appointments on WPSec AttackSurface
- Fix released
- Published
Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'edit' attribute of the [ssa_booking] shortcode in all versions up to, and including, 1.6.12.35, due to the shortcode generating a valid access token for any supplied appointment ID without checking that the current user may access that appointment. This makes it possible for authenticated attackers, with contributor-level access and above, to obtain access tokens for arbitrary appointments and use them to view, modify, or delete those appointments, including the customers' personal information.
References
- https://wpsec.com/vuln/WPSEC-2026-1013/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.12.37/
- https://wordpress.org/plugins/simply-schedule-appointments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS