The vulnerability lies in the plugin's admin embed endpoint /wp-json/ssa/v1/embed-inner-admin, which can be accessed without authentication and returns configuration data such as staff names, business names, and in premium versions, API keys for external services. An unauthenticated attacker can send a simple HTTP request to retrieve this information, compromising the confidentiality of sensitive business configuration and potentially exposing credentials to integrated services.

The vulnerability affects croixhaug's Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin on all WordPress installations running versions up to and including 1.6.9.16. Subsequent releases are not identified as vulnerable based on the current information.

This issue has a CVSS score of 5.3, indicating moderate severity, while the EPSS score of less than 1% signals a low probability of exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw simply by accessing the unauthenticated endpoint, which requires no special privileges or additional conditions.