The vulnerability is a missing authorization flaw (CWE‑862) in NSquared’s Simply Schedule Appointments plugin that allows exploitation of incorrectly configured access‑control security levels. These flaws can enable privileged functions such as creating, editing, or viewing appointments, bypassing intended access restrictions. The flaw exposes sensitive appointment data and enables manipulation of scheduling functions, potentially leading to privacy violations or service disruption.

The plugin is distributed by NSquared under the name Simply Schedule Appointments. Versions up to and including 1.6.11.11 are affected. Any WordPress site using an affected version of the plugin may be exploited if the missing authorization is present.

The CVSS score of 6.5 indicates moderate severity, while the very low EPSS of less than 1% suggests a small current exploitation probability and it is not listed in CISA’s KEV catalog. The CVE description does not state the exact attack vector or authentication requirements; it only notes a missing authorization flaw that uses incorrectly configured access‑control security levels. Based on common patterns of broken access control, it is inferred that an attacker could use crafted HTTP requests to trigger privileged actions exposed by the plugin, although whether anonymous or authenticated users are needed is unclear.