CVE-2026-91109: Simply Schedule Appointments IDOR Vulnerability

CVE-2026-91109 Overview

CVE-2026-91109 is an Insecure Direct Object Reference (IDOR) vulnerability in the Simply Schedule Appointments plugin for WordPress. The flaw affects all versions up to and including 1.6.12.31. The plugin fails to validate a user-controlled key passed through the complete_group parameter. Authenticated attackers with subscriber-level access or above can exploit the issue to disclose co-bookers' private per-appointment id_token values along with associated personally identifiable information (PII). Attackers can then reuse those leaked tokens to read, overwrite arbitrary appointment metadata, or cancel other users' appointments through the same REST controller.

Critical Impact
Low-privileged WordPress users can enumerate private appointment tokens and PII of all co-bookers in a group booking, then tamper with or cancel their appointments.

Affected Products

Simply Schedule Appointments plugin for WordPress
All versions up to and including 1.6.12.31
Deployments allowing subscriber-level or higher authenticated access

Discovery Timeline

2026-10-01 - CVE-2026-91109 published to the National Vulnerability Database (NVD)
2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-91109

Vulnerability Analysis

The vulnerability is categorized as [CWE-639: Authorization Bypass Through User-Controlled Key]. The plugin's REST controller processes the complete_group parameter without verifying that the requesting user owns the group booking or its member appointments. An attacker only needs a single valid id_token for any one appointment inside a group booking to pivot across the entire group.

Once the attacker triggers the complete_group flow, the server returns per-appointment token values that the plugin exposes as public_token, along with each co-booker's name and email address. These tokens are the same identifiers the REST controller trusts for subsequent read, update, and cancel actions. Confidentiality impact is high because both tokens and PII are leaked. Integrity and availability of other users' appointment records are also at risk through follow-on calls using the leaked tokens.

Root Cause

The root cause is missing authorization on a user-controlled key inside class-appointment-model.php. The code paths referenced at lines 1966, 2315, and 3160, together with class-db-model.php line 348, resolve records directly from attacker-supplied identifiers without an ownership or capability check. See the WordPress plugin changeset for the applied fix.

Attack Vector

Exploitation occurs over the network against the WordPress REST API. The attacker must authenticate as at least a subscriber and must already hold a valid id_token for one appointment inside the targeted group booking. A crafted request to the group completion endpoint returns the private tokens and PII of every co-booker. The attacker then issues follow-up REST calls, substituting each leaked public_token to read details, mutate appointment meta, or cancel bookings belonging to other users.

No verified public exploit code is available. Technical details are documented in the Wordfence vulnerability report.

Detection Methods for CVE-2026-91109

Indicators of Compromise

Unexpected REST API requests to the Simply Schedule Appointments complete_group endpoint originating from subscriber-level accounts.
Spikes in appointment read, update, or cancel REST calls referencing many distinct public_token values from a single authenticated session.
Appointments cancelled or modified without a corresponding action in the WordPress admin audit log.
Customer complaints about altered appointment times, metadata changes, or unexplained cancellations.

Detection Strategies

Enable WordPress REST API request logging and alert on authenticated subscriber accounts invoking appointment plugin endpoints.
Correlate authenticated session identifiers against the number of unique appointment tokens accessed within a short time window.
Review the Simply Schedule Appointments plugin version across all WordPress installations and flag any instance at 1.6.12.31 or earlier.

Monitoring Recommendations

Forward WordPress and web server access logs into a centralized analytics platform for retention and query.
Monitor outbound responses from the plugin endpoints for payloads containing multiple id_token or email fields in a single response.
Track plugin update status through a management console and alert when vulnerable versions reappear after rollback.

How to Mitigate CVE-2026-91109

Immediate Actions Required

Update the Simply Schedule Appointments plugin to a version later than 1.6.12.31 that contains the patch from changeset 3709365.
Audit WordPress user accounts and remove unused subscriber-level accounts that could be used for authenticated exploitation.
Review appointment records for unauthorized modifications or cancellations within the exposure window.

Patch Information

The vendor applied the fix in the plugin changeset referenced at plugin changeset 3709365. Administrators should upgrade through the standard WordPress plugin update process and confirm the installed version is above 1.6.12.31.

Workarounds

Temporarily disable the Simply Schedule Appointments plugin until the patched version is installed.
Restrict new user registration and require administrator approval to limit subscriber-level account creation.
Place the WordPress site behind a web application firewall (WAF) with rules blocking requests to the plugin's complete_group endpoint from non-privileged users.

bash

# Verify installed plugin version via WP-CLI
wp plugin get simply-schedule-appointments --field=version

# Update to the patched release
wp plugin update simply-schedule-appointments