The vulnerability in the Simply Schedule Appointments plugin is an unauthenticated broken access control flaw. Based on this description, it is inferred that an attacker could perform actions that should normally require proper authorization, potentially leading to unauthorized modification of appointment data, disclosure of sensitive information, or impersonation. The weakness is classified as CWE-862.

The flaw affects the WordPress plugin Simply Schedule Appointments, maintained by NSquared, for all releases up to and including version 1.6.12.29. Users running 1.6.12.29 or earlier are vulnerable. The vendor‑issued fix begins at version 1.6.12.31, which removes the access control issue.

The CVSS score of 6.5 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation. Based on the description, it is inferred that an attacker can access the plugin’s endpoints without authentication from any network location. The absence of a known public exploit does not eliminate the risk, as the access control issue can be leveraged to gain unauthorized control over the scheduling system.