CVE-2026-13358 is an authorization bypass vulnerability (CWE-639) in the Simply Schedule Appointments Booking Plugin for WordPress. The flaw exists in all versions up to 1.6.12.10 due to missing validation on a user-controlled key (ssa_past_appointments). This allows authenticated users with contributor-level permissions to access appointment records of arbitrary users and extract 32-character ownership tokens embedded in the HTML. These tokens can then be used without authentication to read or modify appointments, including sensitive customer personally identifiable information (PII). The vulnerability is facilitated by the /wp-json/ssa/v1/render-shortcode REST endpoint, which is registered unconditionally and requires only the edit_posts capability, making it exploitable by contributors.

An attacker with contributor-level access can bypass authorization controls to access and manipulate appointment data of other users. This includes harvesting ownership tokens that enable unauthenticated access to sensitive customer information such as names, emails, phone numbers, and private notes. The confidentiality of customer PII is compromised, but there is no indication of impact on data integrity or availability. The CVSS score is 6.5 (medium severity), reflecting the network attack vector, low attack complexity, and partial confidentiality impact without integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or restricting the affected REST API endpoint if possible. Monitor vendor channels for updates and apply patches promptly once released.