Sensitive Information Exposure in Simply Schedule Appointments Plugin for WordPress

CVE-2026-92245

What is CVE-2026-92245?

The Simply Schedule Appointments plugin for WordPress is affected by a serious vulnerability that allows unauthenticated attackers to exploit the 'recursive' parameter. This exposure enables the unauthorized retrieval of sensitive customer Personally Identifiable Information (PII), such as names, email addresses, phone numbers, and custom field data within appointment records. Furthermore, attackers can gain access to per-appointment public tokens, giving them the capability to delete appointments through the DELETE /wp-json/ssa/v1/appointments/{id} endpoint, relying solely on the public token for authentication.

References