The vulnerability allows unauthenticated users to retrieve sensitive plugin settings through the WordPress REST API. Because the plugin’s settings endpoint accepts a nonce that is not user-bound and fails to filter restricted fields, an attacker can read the administrator email, phone number, internal access tokens, notification configurations, and developer settings. This disclosure of confidential information may enable further malicious actions such as modifying or canceling appointments and abusing internal tokens. The weakness corresponds to Missing Authorization (CWE‑862).

All WordPress installations running the Appointment Booking Calendar — Simply Schedule Appointments plugin version 1.6.9.29 or earlier are affected. This applies to the plugin product disclosed by croixhaug.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it via unauthenticated network requests to the /wp-json/ssa/v1/settings/{section} endpoint using a publicly exposed nonce. The absence of a user check means any visitor of the site’s REST API can gain the exposed data, making the attack vector straightforward for remote unauthenticated attackers.