CVE-2026-3045 is a high-severity authorization vulnerability (CWE-862) in the Simply Schedule Appointments WordPress plugin. The vulnerability arises because a non-user-bound public nonce is exposed to unauthenticated users through the /wp-json/ssa/v1/embed-inner REST endpoint. The get_item() method in SSA_Settings_Api relies on nonce_permissions_check() for authorization, which accepts this public nonce, but does not invoke remove_unauthorized_settings_for_current_user() to filter out admin-only settings. Consequently, unauthenticated attackers can retrieve sensitive administrative settings and appointment tokens via the /wp-json/ssa/v1/settings/{section} endpoint, potentially allowing modification or cancellation of appointments.

This vulnerability allows unauthenticated attackers to access sensitive administrative data including administrator contact details, internal access tokens, and configuration settings. Additionally, attackers can leverage exposed appointment tokens to modify or cancel appointments without authorization. The confidentiality of sensitive data is compromised, but there is no indication of impact on integrity beyond appointment modification or cancellation, and no availability impact is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict access to the affected REST API endpoints if possible, and monitor plugin updates from the vendor. Avoid exposing the plugin to unauthenticated users or consider disabling the plugin if sensitive data exposure risk is unacceptable.