CVE-2026-13358
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Appointment Booking Calendar plugin for WordPress up to version 1.6.12.10 is vulnerable to Insecure Direct Object Reference via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated attackers with contributor-level access can access appointment records of arbitrary users, including ownership tokens and full customer PII. The REST endpoint is registered unconditionally and only requires edit_posts capability.
Risk Assessment
The risk includes patient privacy breach, theft of personal data, and unauthorized modification of appointments. The attack can be performed by low-privileged accounts, increasing the threat.
Recommendation
Immediately update the plugin to a patched version. Also restrict user permissions and monitor access to REST endpoints.
Other vulnerabilities in Appointment Booking Calendar
See all- CVE-2026-6723Medium
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to Incorrect Authorization in all versions up to and including 1.6.11.11 due to the appointment update REST API endpoint not restricting which fields can be modified by token-authenticated customers. This allows unauthenticated attackers to modify admin-controlled fields on that appointment, including faking payment confirmation, reassigning the appointment to another user, and changing the service type.
- CVE-2026-12113Medium
The Appointment Booking Calendar plugin for WordPress up to version 1.4.02 exposes sensitive information via the cpabc_appointments_filter_list parameter. This allows authenticated attackers with contributor-level access or higher to extract customer personal identifiable information such as names, email addresses, phone numbers, appointment comments, and other booking details.
- CVE-2025-13317Medium
The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.3.96. The plugin exposes an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. Unauthenticated attackers can arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.
- CVE-2025-64261Medium
The Appointment Booking Calendar plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions up to and including 1.3.95.
Original NVD description (English source)
The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.10 via the ssa_past_appointments due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with contributor-level access and above, to access appointment records belonging to arbitrary users and harvest the per-appointment ownership tokens (32-character hashes) embedded in the rendered HTML, which can then be used without any authentication to read or modify those appointments including full customer PII such as name, email, phone number, and private notes. The /wp-json/ssa/v1/render-shortcode REST endpoint is registered unconditionally on rest_api_init regardless of whether the Divi theme is installed, and its permission callback only requires current_user_can('edit_posts'), meaning any Contributor-level account is sufficient to trigger this entire exploit chain.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS