The vulnerability is an unauthenticated Insecure Direct Object Reference that permits attackers to access data objects in the Simply Schedule Appointments plugin without proper authorization. This flaw is categorized under CWE-639. An attacker who can guess or discover object identifiers could read sensitive booking information or other data associated with the plugin, compromising user confidentiality.

The flaw affects the NSquared Simply Schedule Appointments plugin for WordPress, specifically all releases up to and including version 1.6.12.31. Any system running a vulnerable variant of this plugin is at risk. Versions 1.6.12.33 and later incorporate the fix.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score is not available, so the likelihood of exploitation is uncertain but the absence of a KEV listing suggests no known widespread attacks yet. Attackers can exploit the vulnerability through the application's web interface, leveraging unauthenticated URLs or operations that expose internal object IDs. No public proof-of-concept or exploit is documented in the provided information.