CVE-2026-1704

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter.

• CWE-639

• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1348
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1436
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1348
• https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1436
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3480506%40simply-schedule-appointments%2Ftrunk&old=3475885%40simply-schedule-appointments%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c82f3864-13af-4ff6-824a-4c799a98f3f6?source=cve

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1703When pip is installing and extracting a maliciously crafted …2
• CVE-2026-17032Multiple Supsystic Pro plugins were distributed with malicio…9.8
• CVE-2026-17033An authenticated attacker with Editor access or alert.instan…6.8
• CVE-2026-17037The Kirki – Freeform Page Builder, Website Builder & Customi…7.2
• CVE-2026-17038DrEryk Gabinet before 11.5.0 uses hard-coded API credentials…6.9
• CVE-2026-17039A flaw was found in pki-core. The certificate authority (CA)…3.1
• CVE-2026-17040IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a …9.8
• CVE-2026-17042IBM Power Systems Firmware FW950.00 through FW950.H2, OP940.…7.3
• CVE-2026-17043IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…3.8
• CVE-2026-17044The Iptanus File Upload WordPress plugin before 5.1.8 does n…8.6
• CVE-2026-17045IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authentica…8.1
• CVE-2026-17047IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …5.4