The Appointment Booking Calendar plugin for WordPress suffers from a missing authorization flaw, a CWE-862 vulnerability, rooted in its nonce validation logic. The plugin exposes a site‑wide public_nonce through the /wp-json/ssa/v1/embed-inner endpoint, which is accessible to anyone. The appointment deletion endpoint accepts an X‑WP‑Nonce and an X‑PUBLIC‑Nonce; if the first fails, the request is incorrectly allowed to succeed by validating the second without proper rejection. This defect lets unauthenticated users retrieve appointment details, including sensitive URLs, and delete or modify any appointment by ID, thereby exposing confidential data and disrupting booking services.

The vulnerability impacts the croixhaug Appointment Booking Calendar (Simply Schedule Appointments Booking Plugin) for WordPress in all releases up to and including 1.6.10.6. Any site running these plugin versions with publicly accessible REST API endpoints is susceptible.

With a CVSS score of 6.5 the risk is moderate; the EPSS score is not available, yet the public nonce exposure makes exploitation trivial for an unauthenticated attacker. The flaw is not listed in the CISA KEV catalog. An attacker can craft HTTP requests to the /wp-json/ssa/v1/appointments/* endpoints, supply any X‑WP‑Nonce value together with the valid public nonce from /wp-json/ssa/v1/embed-inner, and immediately view, alter, or delete arbitrary appointments without any authentication or firewall bypass.