CVE-2026-13358 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Simply Schedule Appointments Booking Plugin for WordPress, specifically versions up to and including 1.6.12.10. The vulnerability is triggered via the ssa_past_appointments parameter due to missing validation on a user-controlled key. Authenticated users with contributor-level permissions or higher can exploit this to access appointment records belonging to other users and extract 32-character ownership tokens embedded in the rendered HTML. These tokens allow unauthenticated reading and modification of appointments, including access to full customer personally identifiable information (PII). The REST endpoint /wp-json/ssa/v1/render-shortcode is registered regardless of the presence of the Divi theme and only requires 'edit_posts' permission, enabling contributors to exploit this flaw.

An attacker with contributor-level access can access and modify appointment records of arbitrary users without further authentication. This includes exposure of sensitive customer PII such as names, email addresses, phone numbers, and private notes. The vulnerability compromises confidentiality and integrity of appointment data but does not affect availability. The CVSS 3.1 base score is 6.5 (medium severity) reflecting network attack vector, low attack complexity, and privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only. Monitor for updates from the plugin vendor and apply patches promptly once released. Consider disabling or restricting access to the /wp-json/ssa/v1/render-shortcode REST endpoint if possible.