The vulnerability is an Insecure Direct Object Reference that allows an authenticated user with contributor-level privileges to access appointment data of other users. Leveraging the unprotected /wp-json/ssa/v1/render-shortcode REST endpoint, an attacker can retrieve and parse per‑appointment ownership tokens embedded in the HTML. These tokens can then be used to read or modify appointments, exposing sensitive personal information such as names, emails, phone numbers, and private notes. This breach is a classic example of CWE‑639, where inadequate permission checks enable unauthorized access.

All installations of the Simply Schedule Appointments plugin for WordPress that are at or below version 1.6.12.10 are affected. The vulnerability exists in every build up to that release; upgrading to a later version removes the flaw.

The CVSS score of 6.5 indicates a moderate severity. Because the exploit requires authenticated access, the attack surface is limited to users who have already gained contributor or higher permissions. The endpoint is exposed on the public REST API, so an attacker with legitimate credentials could invoke it from any web client. While EPSS data is unavailable, the lack of a KEV listing suggests that widespread exploitation has not yet been reported. Nonetheless, the potential for PII disclosure warrants prompt attention.