A missing authorization flaw, identified as CWE-862, allows an attacker to bypass controls in the NSquared Simply Schedule Appointments plugin for WordPress. The vulnerability permits read or alteration of appointment data that should be protected, compromising confidentiality and integrity of scheduling information.

WordPress sites running the Simply Schedule Appointments plugin version 1.6.10.2 or earlier are affected, including all earlier releases.

The CVSS base score of 5.3 indicates moderate severity, while an EPSS score of less than 1% reflects a low likelihood of current exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, reducing concerns about active exploitation. Likely attack vectors involve web requests to plugin endpoints that lack proper authorization checks, but specific exploitation steps are not detailed in the advisory and are inferred from the description.