Simply Schedule Appointments: Broken access control (CVE-2026-94074)

CVE-2026-94074 is a broken access control vulnerability in the Simply Schedule Appointments WordPress plugin (versions 1.6.12.29 and earlier). The REST API endpoint /ssa/v1/appointments relies on an MD5 HMAC token for authentication. Due to an input validation error, supplying an appointment ID as a float (e.g., '1.9') causes the application to generate a predictable HMAC token. This allows unauthenticated attackers to access, cancel, or delete appointments. The vulnerability was reported by Mor Golan and a proof-of-concept exploit script is publicly available.

Attack Chain

1. Attacker identifies a site running a vulnerable version of the Simply Schedule Appointments plugin.
2. Attacker crafts a request to the /ssa/v1/appointments endpoint using an appointment ID formatted as a float (e.g., 1.9).
3. The plugin application incorrectly handles the float ID, bypassing the intended token validation logic.
4. Attacker computes the HMAC token offline using the public salt and the manipulated float ID.
5. Attacker sends the request with the forged token to the REST API.
6. The API returns sensitive customer information, including name, email, phone number, and a valid public_token.
7. Attacker uses the harvested public_token to authenticate subsequent requests to cancel or delete the appointment.

Impact

Successful exploitation allows unauthenticated users to perform unauthorized actions, including the exfiltration of personally identifiable information (PII) and the unauthorized deletion of appointment records.

Recommendation

• Update the Simply Schedule Appointments plugin to version 1.6.12.31 or later immediately.
• Audit access logs for anomalous requests to the /ssa/v1/appointments endpoint, specifically those containing float values or unexpected parameters in the appointment ID query.
• Review WordPress plugin inventory to ensure no sites are running the identified vulnerable versions.