Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured… (CVE-2026-59523)

CVE-2026-59523 describes a missing authorization vulnerability in NSquared Simply Schedule Appointments plugin, affecting versions up to and including 1.6.11.11. The issue arises from incorrectly configured access control security levels, which can be exploited remotely without privileges or user interaction. The vulnerability impacts confidentiality and integrity but does not affect availability. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

Successful exploitation could allow an unauthenticated attacker to access or modify data that should be protected by access controls, impacting confidentiality and integrity of the affected system. There is no impact on system availability. No active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and tighten access control configurations in Simply Schedule Appointments to prevent unauthorized access.