blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-13358

MEDIUM 6.5 CVSS 3.1
Published
August 16, 2026
Last modified
August 20, 2026
NVD status
Deferred
Reported by
security@wordfence.com
Weakness
CWE-639
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain.

Affected WordPress components

  • Simply Schedule Appointments Plugin · simply-schedule-appointments
    Confirmed match Active
    Up to and including 1.6.12.10
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • croixhaug Simply Schedule Appointments — Up to and including 1.6.12.10

References

  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-appointment-model.php#L1936
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-db-model.php#L325
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-divi.php#L237
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-divi.php#L254
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.11.0/includes/class-shortcodes.php#L781
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-appointment-model.php#L1936
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-db-model.php#L325
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-divi.php#L237
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-divi.php#L254
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.4/includes/class-shortcodes.php#L781
  • plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?reponame=&old=3617759%40simply-schedule-appointments&new=3617759%40simply-schedule-appointments
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbe5094-d255-46b1-9e8e-9c48cd74e8a2?source=cve
  • nvd.nist.gov Official NVD record