Back to the CVE list

CVE-2026-91109

Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

CVSS score

6.5

EPSS probability

%0.3

Risk score

0.0

Published

18 d ago

Overview Public Exploits (0)Newsroom Vulnerability Timeline

Related Security News

Articles and analysis bulletins in which the press and security publications have covered this vulnerability:

No verified news item has been matched to this CVE yet.

Similar Vulnerabilities

7.5

CVE-2026-89294Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter

Vendorcroixhaug ProductSimply Schedule Appointments

Patch status unknownEPSS %119 d ago

6.5

CVE-2026-13358Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.12.10 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure

Vendorcroixhaug ProductSimply Schedule Appointments

Patch status unknownEPSS %12 mo ago

7.5

CVE-2026-92245Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce

Vendorcroixhaug ProductSimply Schedule Appointments

Patch status unknownEPSS %018 d ago

7.2

CVE-2026-104000Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

Vendorcroixhaug ProductSimply Schedule Appointments

Patch status unknownEPSS %03 d ago

5.3

CVE-2026-6723Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token

Vendorcroixhaug ProductSimply Schedule Appointments

Patch status unknownEPSS %09 d ago

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free key Documentation

curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-91109"