CVE-2026-91109: Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'completegroup' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose every co-booker's private per-appointment idtoken (exposed as publictoken) alongside their PII (name and email address), then use each leaked token to read, overwrite arbitrary appointment meta on, or cancel the co-booker's appointment via the same REST controller. Exploitation requires the attacker to possess a valid idtoken for any single appointment within the targeted group booking.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must also possess a valid id_token for one appointment in the group booking they want to target.
What information and actions become available after exploitation?
The attacker can disclose the private per-appointment id_token, exposed as public_token, and PII including names and email addresses for every co-booker in the targeted group. The leaked tokens can then be used through the same REST controller to read or overwrite arbitrary appointment metadata or cancel co-bookers' appointments.
Which versions are affected?
All versions of Simply Schedule Appointments through 1.6.12.31, including that version, are affected.