CVE-2026-13358
Received Received - Intake

Insecure Direct Object Reference in Simply Schedule Appointments WordPress Plugin

Publication date: 2026-08-16

Last updated on: 2026-08-16

Assigner: Wordfence

Description
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-16
Last Modified
2026-08-16
Generated
2026-08-16
AI Q&A
2026-08-16
EPSS Evaluated
N/A
NVD
CVE-2026-13358
EUVD
EUVD-2026-59859

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simply_schedule_appointments appointment_booking_calendar to 1.6.12.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This WordPress plugin vulnerability allows authenticated users with contributor access or higher to access other users' appointment records due to missing validation on a user-controlled key. Attackers can harvest tokens embedded in HTML to read or modify appointments without further authentication, exposing customer PII like names, emails, phone numbers, and private notes.

Detection Guidance

Check WordPress sites using the Appointment Booking Calendar plugin for the vulnerable endpoint /wp-json/ssa/v1/render-shortcode. Inspect network traffic for unauthorized access to appointment records or harvesting of ownership tokens.

Impact Analysis

If you use this plugin, attackers could steal sensitive customer data including personal contact information and private notes. They could also modify or delete appointments, disrupting your booking system and damaging customer trust.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and HIPAA if it involves protected health information. It exposes organizations to compliance violations, potential fines, and reputational damage from data breaches.

Mitigation Strategies

Update the Appointment Booking Calendar plugin to the latest version beyond 1.6.12.10. Remove contributor-level access for users who do not need it. Monitor for suspicious activity on appointment endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13358. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart