This vulnerability involves an authorization bypass through user-controlled keys in the Simply Schedule Appointments plugin by NSquared. Specifically, unauthenticated insecure direct object references (IDOR) exist in versions up to 1.6.12.31, allowing attackers to access resources without proper authorization checks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact without integrity or availability impact.

An attacker can exploit this vulnerability remotely without authentication to access certain data or resources that should be protected by authorization controls. The impact is limited to partial confidentiality loss, with no integrity or availability effects reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor NSquared's advisories for updates and apply patches once available.