An authorization flaw in the Simply Schedule Appointments WordPress plugin allows unauthenticated attackers to access or destroy sensitive appointment records.

This is an improper authorization vulnerability (CWE-863) where the plugin fails to perform necessary capability checks on bulk appointment operations. This allows unauthenticated users to perform unauthorized data retrieval and, in premium versions, data deletion.

The successful exploitation of this vulnerability poses a significant risk to data privacy and operational integrity. With a CVSS score of 7.5, the vulnerability is classified as high severity, enabling unauthorized access to potentially sensitive customer information and the potential for mass data loss through unauthorized deletion.

Immediate Action: Update the Simply Schedule Appointments plugin to version 1.6.12.6 or later immediately.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting appointment-related API endpoints or bulk operation functions.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests targeting plugin-specific appointment management endpoints.

Public Exploit Available: Yes, a public Proof-of-Concept is available via GitHub.

Given the high impact on data confidentiality and integrity, organizations utilizing this plugin must prioritize the update to version 1.6.12.6. Failure to patch leaves the system open to unauthorized data exfiltration and potential service disruption.