Simply Schedule Appointments Plugin <=1.6.12.10 IDOR to Sensitive Info Disclosure (CVE-2026-13358)

Vulnerability Overview Vulnerability Name: Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure CVE ID: CVE-2026-13358 CVSS Score: 6.5 (Medium) Publication Date: August 15, 2026 Last Updated: August 16, 2026 Researcher: Michael Iden (Mickhat) - Hack The Box Affected Range Software Type: Plugin Software Name: Simply Schedule Appointments Affected Versions: <= 1.6.12.10 Fixed Version: 1.6.12.11 Remediation Recommendation: Upgrade to version 1.6.12.11 or higher. Vulnerability Description The vulnerability exists in the Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin, versions <= 1.6.12.10. The vulnerability type is an Insecure Direct Object Reference (IDOR), leading to the exposure of sensitive information. An attacker can construct specific requests to access and read other users' appointment records, including sensitive data such as names, email addresses, phone numbers, and private notes. References plugins.trac.wordpress.org Share This vulnerability information can be shared via Facebook, X (Twitter), LinkedIn, and Email. Additional Information Recent Vulnerabilities: The page lists other recently discovered vulnerabilities in the Simply Schedule Appointments plugin, including unauthenticated SQL injection and stored cross-site scripting (XSS). Copyright Notice: The bottom of the page contains copyright notices for Defiant Inc. and the MITRE Corporation. Contact Information: Contact email addresses and social media links are provided. Summary This is a medium-severity security issue with a broad impact scope. It is recommended to upgrade to the fixed version as soon as possible to protect user data security.

Goal Reached Thanks to every supporter — we hit 100%!

Simply Schedule Appointments Plugin <=1.6.12.10 IDOR to Sensitive Info Disclosure (CVE-2026-13358)

More from this source