The vulnerability in the Appointment Booking Calendar plugin allows an unauthenticated attacker to call a bulk appointments REST API endpoint without proper authorization checks. This flaw lets the attacker modify any appointment record, changing fields such as customer PII, payment status, and meeting URLs. In addition, the endpoint’s response reveals full customer PII for all appointments, exposing sensitive data. The weakness maps to CWE-862: Missing Authorization

WordPress sites running the croixhaug "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin" with any version up to and including 1.6.11.8 are affected. Sites that include the [ssa_booking] shortcode expose a public static nonce that can be harvested by any visitor

The CVSS score of 5.3 indicates a moderate impact. Exploitation requires only that an attacker reach the REST endpoint, which can be accessed by any website visitor who has seen a page containing the shortcode. Because the nonce is static and public, no authentication or elevated privileges are required. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog.