{
 "id": "WPSEC-2026-2886",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2886/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2886/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2886/index.md",
 "title": "Simply Schedule Appointments <= 1.6.13.0 - Unauthenticated Sensitive Information Exposure via Booking App Appointment Types",
 "description": "The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure via the public booking app page (ssa_embed) in all versions up to, and including, 1.6.13.0, due to the page printing raw appointment type records into its inline JSON, including unpublished appointment types and the connected Google Calendar identifiers, the booking calendar account and the web meeting settings that the appointment types REST listing withholds from visitors. This makes it possible for unauthenticated attackers to view appointment type configuration and connected account details that should not be publicly exposed.",
 "plugin": {
  "slug": "simply-schedule-appointments",
  "name": "Simply Schedule Appointments",
  "full_name": "Simply Schedule Appointments",
  "wordpress_org": "https://wordpress.org/plugins/simply-schedule-appointments/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simply-schedule-appointments/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simply-schedule-appointments"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.6.13.4",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.6.13.4"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.6.13.4",
 "remediation": "Update to 1.6.13.4 or later.",
 "fix_released": "2026-11-10T20:33:39+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:08:18.401852+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2886/",
  "https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.13.4/",
  "https://wordpress.org/plugins/simply-schedule-appointments/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simply-schedule-appointments",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-12"
 }
}