CVE-2026-92245 describes a missing authorization vulnerability in the Simply Schedule Appointments WordPress plugin (versions up to 1.6.12.32). The issue arises from improper access control on the 'recursive' parameter, which allows unauthenticated attackers to retrieve personally identifiable information (PII) from appointment records. The exposed per-appointment public_token values can be used as sole authorization tokens to delete any appointment via the DELETE /wp-json/ssa/v1/appointments/{id} REST API endpoint. This results in sensitive information exposure and unauthorized deletion capabilities.

Unauthenticated attackers can extract sensitive customer PII such as names, email addresses, phone numbers, and custom form data from appointment records. They can also delete arbitrary appointments by leveraging leaked public_token values as authorization tokens. This compromises customer privacy and appointment data integrity, but does not directly impact system availability or integrity beyond appointment deletion.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoints and monitor for suspicious activity. Avoid exposing the 'recursive' parameter publicly and consider disabling the plugin if sensitive data exposure risk is unacceptable.