CVE-2026-1704: 
WordPress vulnerability analysis and mitigation

CVE-2026-1704 is an Insecure Direct Object Reference (IDOR) vulnerability in the "Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin" for WordPress. It affects all versions up to and including 1.6.9.29, allowing authenticated attackers with the ssa_manage_appointments capability (e.g., Team Members) to access appointment records belonging to other staff members and expose sensitive customer PII. The vulnerability was published on March 13, 2026, and carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is an authorization bypass through a user-controlled key (CWE-639). Specifically, the get_item_permissions_check method in class-appointment-model.php grants access to any user holding the ssa_manage_appointments capability without verifying that the requesting user is the staff member who owns the appointment. An authenticated attacker can manipulate the appointment ID parameter in API requests to retrieve appointment records they do not own, exposing customer PII such as names, contact details, and scheduling information (Wordfence, WordPress Trac).

Successful exploitation allows authenticated low-privileged users (Team Members or any user granted ssa_manage_appointments) to read appointment records belonging to other staff members, including sensitive customer personally identifiable information (PII) such as names, email addresses, and phone numbers. The impact is limited to confidentiality — there is no integrity or availability impact — and exploitation requires an existing account on the WordPress site. Lateral movement beyond the WordPress application is not directly facilitated by this vulnerability (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Wordfence).

1. Reconnaissance: Identify a WordPress site running the Simply Schedule Appointments plugin at version 1.6.9.29 or earlier. Confirm the site has the plugin active and that Team Member accounts exist.
2. Obtain authenticated access: Register or obtain credentials for an account with the ssa_manage_appointments capability (e.g., a Team Member role).
3. Enumerate appointment IDs: Send authenticated REST API requests to the plugin's appointment endpoint, iterating over appointment ID values (e.g., incrementing integers) in the request parameter.
4. Access unauthorized records: For each appointment ID not owned by the attacker's staff account, the get_item_permissions_check method will incorrectly grant access, returning the full appointment record including customer PII.
5. Exfiltrate PII: Collect customer names, contact information, and scheduling details from the returned appointment records (Wordfence, WordPress Trac).

• Network: Unusual authenticated REST API requests to the Simply Schedule Appointments plugin endpoint with sequentially or randomly enumerated appointment ID parameters from a single user account.
• Logs: WordPress access logs showing repeated GET/POST requests to the plugin's appointment API endpoint (/wp-json/ssa/v1/appointments/<id>) from a Team Member account accessing IDs outside their normal scope.
• Application: A single ssa_manage_appointments user account accessing a high volume of appointment records in a short time period, particularly records not associated with their staff profile.

Users should update the Simply Schedule Appointments plugin to a version beyond 1.6.9.29, which includes the fix applied in the changeset that corrects the get_item_permissions_check method to validate staff ownership of appointments. The patch is available via the WordPress plugin repository. As a temporary workaround, site administrators can restrict the ssa_manage_appointments capability to only fully trusted users until the update is applied (Wordfence, WordPress Trac Changeset).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for March 9–15, 2026, and Sucuri included it in their March 2026 vulnerability patch roundup. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation (Wordfence Blog, Sucuri Blog).