Simply Schedule Appointments <= 1.6.12.10 - Missing Authorization to Authenticated (Contributor+) Sensitive Data Disclosure

The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.6.12.10. This is due to missing capability checks on user-controlled shortcode attributes in the ssa_admin_upcoming_appointments shortcode handler, allowing non-managers to bypass staff scoping and read arbitrary appointment records. This makes it possible for authenticated attackers, with contributor-level access and above, to view other customers' appointment data by embedding admin shortcodes with arbitrary customer or staff scope parameters in a post or page.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: Simply Schedule Appointments 1.6.12.11 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts