The flaw is an insecure direct object reference that allows a user with a subscriber or higher role to retrieve the private per‑appointment id_token and PII of all co‑bookers within a group booking. Because the id_token is exposed as a public token, the attacker can then use that token to read or alter arbitrary appointment metadata or cancel the associated appointment. The weakness is categorized as CWE‑639 (Unauthorized Access to Real-World Objects). This results in confidentiality loss of PII and potential integrity and availability impact on appointments.

The vulnerability affects the Simply Schedule Appointments plugin for WordPress provided by croixhaug. All plugin versions up to and including 1.6.12.31 are impacted. No specific build numbers beyond 1.6.12.31 have been identified as affected.

The CVSS v3.1 score of 6.5 indicates a medium severity finding. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current widespread exploitation reports. However, the attack requires only authenticated access at the subscriber level and possession of a valid id_token for any appointment within the group; these conditions are likely to exist in typical installations, making exploitation plausible if the attacker can obtain a token by legitimate participation.