CVE-2026-92245

Summary

The Simply Schedule Appointments WordPress plugin has a missing authorization check that allows unauthenticated users to access sensitive customer appointment data through a recursive parameter, exposing personal information and enabling appointment deletion using public tokens.

Exploitability

Exploitation is straightforward requiring no authentication or special conditions, as attackers can simply call the vulnerable endpoint with the recursive parameter to extract PII and use public tokens to delete appointments.

Blast radius

The vulnerability affects all users of the plugin up to version 1.6.12.32, potentially exposing thousands of customer records including names, emails, phone numbers, and form data, along with enabling unauthorized appointment deletions.

Detection

Monitor for unusual GET requests to /wp-json/ssa/v1/appointments/ endpoints with recursive parameters, and watch for DELETE requests to /wp-json/ssa/v1/appointments/{id} using public_token values in access logs.

Prioritized remediation

Upgrade to version 1.6.12.33 or later to fix the sensitive information exposure vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.