Vulnerabilities / Simply Schedule Appointments / WPSEC-2026-1016
Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Incorrect Authorization to Group Appointment Cancellation and Deletion
Medium 6.5
CWE-863Fixed in 1.6.12.37
- ID
- WPSEC-2026-1016
- Plugin
- Simply Schedule Appointments (simply-schedule-appointments)
- Affected
- all versions before 1.6.12.37
- Remediation
- Update to 1.6.12.37 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-15
- Attack surface
- Simply Schedule Appointments on WPSec AttackSurface
- Fix released
- Published
Description
The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized cancellation and deletion of group appointments in all versions up to, and including, 1.6.12.35, due to the group cancel and group delete REST endpoints authorizing a request through ownership of the group's lead appointment alone. This makes it possible for unauthenticated attackers who made the lead booking of a group event to cancel or delete the bookings of every other attendee in that group. Group event booking is a feature of the plugin's paid editions.
References
- https://wpsec.com/vuln/WPSEC-2026-1016/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.12.37/
- https://wordpress.org/plugins/simply-schedule-appointments/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS