CVE-2026-1704

Name of the Vulnerable Software and Affected Versions Simply Schedule Appointments Booking Plugin versions prior to 1.6.9.30

Description The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. This occurs because the get item permissions check method allows access to users possessing the ssa manage appointments capability without verifying staff ownership of the appointment. This allows authenticated attackers with custom-level access or higher (users with the ssa manage appointments capability, like Team Members) to view appointment records belonging to other staff members and access sensitive customer personally identifiable information through the appointment ID parameter.

Recommendations Update Simply Schedule Appointments Booking Plugin to version 1.6.9.30 or later.