CVE-2026-1704

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.

• CWE-639

• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1348
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1436
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1348
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1436
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480506%40simply-schedule-appointments%2Ftrunk&old=3475885%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=cve

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-17021The Salon Booking System WordPress plugin through 10.30.33 …5.3
• CVE-2026-17022The Salon Booking System WordPress plugin through 10.30.33 …7.5
• CVE-2026-17023The Salon Booking System WordPress plugin through 10.30.33 …4.8
• CVE-2026-1703When pip is installing and extracting a maliciously crafted …2
• CVE-2026-17032Multiple Supsystic Pro plugins were distributed with malicio…9.8
• CVE-2026-17039A flaw was found in pki-core. The certificate authority (CA)…3.1
• CVE-2026-17044The Iptanus File Upload WordPress plugin before 5.1.8 does n…8.6
• CVE-2026-17048A flaw was found in the Keycloak Admin REST API, which is us…4.9
• CVE-2026-1705A vulnerability was detected in D-Link DSL-6641K N8.TR069.20…2.4
• CVE-2026-17059A flaw was found in the role-users endpoint of the keycloak-…6.5
• CVE-2026-1706The All-in-One Video Gallery plugin for WordPress is vulnera…6.1
• CVE-2026-17061A Deserialization of Untrusted Data vulnerability affecting …10