Technical impact
The vulnerability is an insecure direct object reference that allows authenticated users with the ssa_manage_appointments capability to extract appointment records belonging to other staff members. This results in disclosure of personally identifiable customer information. The weakness is identified as CWE-639 "Authorization Bypass Through User Controlled Key". Key detail from vendor description: "The get_item_permissions_check method grants access to users with the ssa_manage_appointments capability without validating staff ownership of the requested appointment."
Affected Systems
The issue affects the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, versions up to and including 1.6.9.29, distributed by croixhaug. Any installation running those versions is susceptible.
Risk and Exploitability
The CVSS v3.1 base score is 4.3 indicating medium severity. EPSS is below 1%, suggesting low exploitation probability at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and possess the ssa_manage_appointments capability, which is typically granted to team members or staff. Since the scope is limited to the capability access, the risk is mitigated if role permissions are strictly enforced, but at present the vulnerability can be exploited by any user with that role to read other staff's appointments.
