The vulnerability resides in the Simply Schedule Appointments WordPress plugin prior to version 1.6.12.6, where a bulk appointment operation fails to enforce proper requestor ownership checks. The result is that any user, even unauthenticated, can retrieve the personal data of every scheduled appointment across the entire site, and on premium editions can permanently delete all appointments. This allows an attacker to compromise confidentiality by reading all appointment data and to compromise integrity by removing all records, potentially causing loss of service or data loss to users. The weakness reflects broken access control and sensitive data exposure, classified as CWE-863.

All WordPress sites that use the Simply Schedule Appointments plugin with a version earlier than 1.6.12.6, regardless of the installation environment or user roles. The issue appears on both free and premium editions, but the deletion capability is only available on the premium line.

The EPSS score of less than 1% suggests that, on average, this vulnerability is unlikely to be actively exploited, and it is not listed in the CISA KEV catalog. However, the flaw is exploitable by anyone with network access to the site, requiring no authentication. An attacker can simply query the purge or bulk appointment endpoints to read or delete data. The attack vector is presumed to be a standard HTTP request to the plugin’s REST API endpoints, executed by an unauthenticated client. The CVSS score is 7.5, indicating a high severity vulnerability.