The Simply Schedule Appointments WordPress plugin before version 1.6.12.6 fails to properly restrict bulk appointment operations to the requester's own records. This authorization flaw (CWE-863) enables unauthenticated attackers to retrieve sensitive personal data from all appointments across the site. Furthermore, on premium editions, the flaw allows permanent deletion of appointment data. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact.

Unauthenticated attackers can access personal data of all appointments on the affected site, leading to a significant confidentiality breach. On premium editions, attackers can also permanently delete appointment records, causing data loss. There is no reported impact on system integrity or availability beyond data deletion. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin's bulk appointment operations and monitor for unauthorized access attempts. Avoid using premium features that allow bulk deletion if possible. Follow vendor updates closely for an official patch or temporary mitigation.