The vulnerability is an Insecure Direct Object Reference that allows an attacker to bypass authorization by manipulating a user-controlled key. This defect lets an authenticated user read, modify, or delete appointment records belonging to other users, potentially exposing personal or sensitive information and disrupting scheduling operations.

Any WordPress site using the Simply Schedule Appointments plugin from the initial release up to and including version 1.6.12.35 is affected. Sites running NSquared’s plugin in those versions must ensure they are not using the vulnerable code path.

The CVSS score of 6.3 indicates a medium severity impact, and the EPSS value of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to authenticate to the site and supply a malicious identifier to gain access to another user’s data; no remote code execution or privilege escalation is disclosed.