CVE-2026-13358 is an authorization bypass vulnerability (CWE-639) in the Simply Schedule Appointments Booking Plugin for WordPress. The flaw exists in all versions up to and including 1.6.12.10, where the ssa_past_appointments parameter lacks proper validation. This allows authenticated attackers with contributor-level privileges or higher to access appointment records of arbitrary users and extract per-appointment ownership tokens embedded in the HTML. These tokens can then be used without further authentication to read or modify appointments, exposing full customer personally identifiable information such as names, emails, phone numbers, and private notes. The REST endpoint /wp-json/ssa/v1/render-shortcode is registered unconditionally and requires only the edit_posts capability, enabling this exploit chain.

Attackers with contributor-level access can bypass authorization controls to access and modify appointment data belonging to other users. This includes exposure of sensitive customer PII such as names, emails, phone numbers, and private notes. The vulnerability does not impact availability or integrity beyond appointment data but poses a significant privacy risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and monitor for suspicious activity related to appointment data access. Avoid exposing the vulnerable REST endpoint if possible by disabling or restricting access to the /wp-json/ssa/v1/render-shortcode endpoint.