CVE-2026-94673: WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Simply Schedule Appointmentsto a version that resolves this vulnerability.Fixed in 1.6.12.33
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the affected site.
Which installations are affected?
Simply Schedule Appointments versions up to and including 1.6.12.31 are affected. The provided data does not identify any configuration prerequisite.
What security impact is indicated?
The severity vector indicates low confidentiality impact, with no integrity or availability impact. The issue is remotely reachable and requires low attack complexity, no privileges, and no user interaction.