CVE-2026-110381: WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.12.35.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/simply-schedule-appointmentsto a version that resolves this vulnerability.Fixed in 1.6.12.37
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is network-accessible and requires an authenticated account with low privileges. No user interaction is required.
Which installations are affected?
NSquared Simply Schedule Appointments is affected through version 1.6.12.35. The available data does not state whether any particular WordPress or plugin configuration is required.
What impact could successful exploitation have?
Successful exploitation may allow unauthorized access-control bypass through a user-controlled key. The reported impact includes low confidentiality, integrity, and availability effects.