# Simply Schedule Appointments <= 1.6.13.0 - Unauthenticated Sensitive Information Exposure via Booking App Appointment Types

- **ID:** WPSEC-2026-2886
- **Plugin:** Simply Schedule Appointments (`simply-schedule-appointments`), https://wordpress.org/plugins/simply-schedule-appointments/
- **Affected versions:** all versions before 1.6.13.4
- **Fixed in:** 1.6.13.4 (Update to 1.6.13.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simply-schedule-appointments
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2886/

## Description

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure via the public booking app page (ssa_embed) in all versions up to, and including, 1.6.13.0, due to the page printing raw appointment type records into its inline JSON, including unpublished appointment types and the connected Google Calendar identifiers, the booking calendar account and the web meeting settings that the appointment types REST listing withholds from visitors. This makes it possible for unauthenticated attackers to view appointment type configuration and connected account details that should not be publicly exposed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2886/
- https://plugins.svn.wordpress.org/simply-schedule-appointments/tags/1.6.13.4/
- https://wordpress.org/plugins/simply-schedule-appointments/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2886/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.