The Simply Schedule Appointments plugin contains a logic error in the "recursive" parameter of the appointment_types REST endpoint. When the parameter is supplied, the plugin returns full appointment records that include customer names, email addresses, phone numbers, custom form field data, and the appointment’s public_token. Because the public_token is accepted as the sole authorization credential for the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, an unauthenticated attacker can first read private information and then delete arbitrary appointments. This weakness is a missing authorization flaw (CWE‑862) that compromises confidentiality and availability.

Any installation of the croixhaug Simply Schedule Appointments WordPress plugin with a version of 1.6.12.32 or earlier is affected. These releases expose the vulnerable REST endpoint and the associated public_token values.

The vulnerability has a CVSS score of 7.5, indicating high severity. EPSS data is not available, so the current likelihood of exploitation is unknown, and it is not yet listed in the CISA KEV catalog. The attack vector is remote via the public WordPress REST API and requires no authentication, making it trivially exploitable by any attacker who can query the endpoint and provide a recursive parameter value.