CVE-2026-13358

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin versions prior to 1.6.12.11

Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key within ssa past appointments. Authenticated attackers with contributor-level access or higher can exploit the /wp-json/ssa/v1/render-shortcode REST endpoint to access appointment records of arbitrary users. This allows the harvesting of per-appointment ownership tokens, which are 32-character hashes embedded in the HTML. These tokens can be used without authentication to read or modify appointments, exposing personally identifiable information (PII) such as names, emails, phone numbers, and private notes.

Recommendations Update the plugin to a version newer than 1.6.12.10.