CVE-2026-92245: Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including names, email addresses, phone numbers, and custom form field data — stored in appointment records, as well as per-appointment publictoken values. The leaked per-appointment publictoken values also enable unauthenticated attackers to delete arbitrary appointments via the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, which accepts the token as sole authorization.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
All versions of the Simply Schedule Appointments WordPress plugin up to and including 1.6.12.32 are affected.
Does exploitation require an account or user interaction?
No. The vulnerability is exploitable remotely without authentication, privileges, or user interaction.
What information can be exposed?
An attacker can obtain appointment-record customer PII, including names, email addresses, phone numbers, custom form-field data, and per-appointment public_token values.
How can exposed tokens be abused?
A leaked per-appointment public_token can be used as the sole authorization for the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, allowing an unauthenticated attacker to delete appointments.