# Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Incorrect Authorization to Group Appointment Cancellation and Deletion

- **ID:** WPSEC-2026-1016
- **Plugin:** Simply Schedule Appointments (`simply-schedule-appointments`), https://wordpress.org/plugins/simply-schedule-appointments/
- **Affected versions:** all versions before 1.6.12.37
- **Fixed in:** 1.6.12.37 (Update to 1.6.12.37 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simply-schedule-appointments
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1016/

## Description

The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized cancellation and deletion of group appointments in all versions up to, and including, 1.6.12.35, due to the group cancel and group delete REST endpoints authorizing a request through ownership of the group's lead appointment alone. This makes it possible for unauthenticated attackers who made the lead booking of a group event to cancel or delete the bookings of every other attendee in that group. Group event booking is a feature of the plugin's paid editions.

## References

- https://wpsec.com/vuln/WPSEC-2026-1016/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.12.37/
- https://wordpress.org/plugins/simply-schedule-appointments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1016/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.