PT-2026-25152 · Croixhaug · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Itthidej Aramsri · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-1704

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin versions prior to 1.6.9.30

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This occurs because the get item permissions check method allows access to users possessing the ssa manage appointments capability without verifying staff ownership of the appointment. This allows authenticated attackers with custom-level access or higher (users with the ssa manage appointments capability, like Team Members) to view appointment records belonging to other staff members and access sensitive customer personally identifiable information through the appointment ID parameter.

Recommendations Update Simply Schedule Appointments Booking Plugin to version 1.6.9.30 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-1704

Affected Products

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1704 · Security Note
• https://t.me/CVEtracker/47329 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480506%40simply-schedule-appointments%2Ftrunk&old=3475885%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=cve · Note
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1348 · Note
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1348 · Note
• https://twitter.com/infoflowcloud/status/2032389088943157484 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1436 · Note
• https://twitter.com/CVEnew/status/2032387548945993940 · Twitter Post
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1436 · Note