CVE-2026-91109 is an Insecure Direct Object Reference vulnerability (CWE-639) in the Simply Schedule Appointments WordPress plugin versions up to and including 1.6.12.31. The vulnerability arises from missing validation on the user-controlled 'complete_group' parameter, enabling authenticated attackers with subscriber-level privileges or higher to disclose private per-appointment tokens (id_token exposed as public_token) and personally identifiable information (name and email) of co-bookers. Attackers can then leverage these tokens to read, overwrite arbitrary appointment metadata, or cancel appointments via the same REST controller. Exploitation requires an attacker to have a valid id_token for any appointment within the targeted group booking.

An attacker with subscriber-level access can disclose sensitive personal information of co-bookers, including names and email addresses, and manipulate or cancel their appointments. This compromises user privacy and appointment integrity but does not affect system availability or integrity beyond appointment data. The CVSS 3.1 score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and no user interaction required.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to group bookings. Avoid sharing valid appointment tokens to reduce risk of exploitation.