CVE-2026-1704

Description

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.

PUBLISHED Reserved 2026-01-30 | Published 2026-03-13 | Updated 2026-03-13 | Assigner Wordfence

Problem types

CWE-639 Authorization Bypass Through User-Controlled Key

Product status

Timeline

Credits

Itthidej Aramsri finder

References

www.wordfence.com/...-13af-4ff6-824a-4c799a98f3f6?source=cve

plugins.trac.wordpress.org/...es/class-appointment-model.php

plugins.trac.wordpress.org/...es/class-appointment-model.php

plugins.trac.wordpress.org/...es/class-appointment-model.php

plugins.trac.wordpress.org/...es/class-appointment-model.php

plugins.trac.wordpress.org/...%2Ftrunk&sfp_email=&sfph_mail=

cve.org (CVE-2026-1704)

nvd.nist.gov (CVE-2026-1704)

Download JSON