CVE-2026-92245 in Simply Schedule Appointments Plugin
Summary
by MITRE • 10/01/2026
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment public_token values. The leaked per-appointment public_token values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in the Simply Schedule Appointments plugin for WordPress represents a critical failure in access control and data sanitization mechanisms within versions up to 1.6.12.32. This flaw is specifically triggered through the manipulation of the recursive parameter, which allows unauthenticated actors to bypass intended security boundaries. The core technical issue stems from improper validation of input parameters that govern how appointment data is retrieved or processed by the application backend. When an attacker supplies a crafted value for this parameter, the underlying logic fails to restrict access based on user authentication status or ownership rights. Consequently, the system exposes sensitive information that should be restricted to authenticated administrators or specific users with legitimate permissions. This type of misconfiguration aligns closely with CWE-200, which defines Information Exposure as any situation where an application inadvertently reveals more data about its internal state than intended.
The operational impact of this vulnerability is severe due to the nature of the exposed data. Attackers can extract personally identifiable information belonging to customers who have booked appointments using the plugin. This includes full names, email addresses, phone numbers, and any custom form field data that was submitted during the booking process. The exposure of such sensitive personal data constitutes a significant privacy violation and potentially breaches regulatory frameworks such as GDPR or CCPA depending on the jurisdiction and nature of the business operations. Furthermore, the vulnerability extends beyond mere information disclosure to include unauthorized modification capabilities. By extracting per-appointment public_token values from the exposed records, attackers gain the ability to perform destructive actions without any form of authentication.
The exploitation chain is particularly dangerous because it combines data theft with integrity compromise. Once an attacker obtains a valid public_token for a specific appointment through the information exposure flaw, they can utilize this token as the sole authorization mechanism to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint. This means that any appointment record in the system is vulnerable to deletion by anyone who knows or guesses the associated token structure or retrieves it from other exposed sources. This capability undermines the reliability of the scheduling service, potentially causing business disruption and loss of customer trust. From a threat modeling perspective, this behavior maps directly to ATT&CK technique T1530, which covers Data from Cloud Storage Objects, as well as T1485 regarding Data Destruction. The lack of proper authorization checks on both read and write operations highlights a fundamental design flaw in how the plugin handles state changes and data retrieval for appointment records.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary defense is to upgrade the Simply Schedule Appointments plugin to a version later than 1.6.12.32, where these access control flaws have been patched by the developers. Until an update can be applied, administrators should consider restricting access to the WordPress REST API endpoints if possible through web application firewall rules or server-level configurations that limit exposure of sensitive paths. Additionally, implementing strict input validation and output encoding for all parameters interacting with appointment data is essential to prevent similar exploitation vectors in future versions. Security audits focusing on authorization logic, particularly around public-facing tokens and recursive processing functions, are recommended to ensure that no other endpoints suffer from analogous weaknesses. Regular monitoring of application logs for unusual patterns of access to customer data can also aid in early detection of potential exploitation attempts.