# CVE-2026-91109: Simply Schedule Appointments insecure direct object reference

Source: https://junglewise.ai/threats/cve-2026-91109-the-simply-schedule-appointments-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-01. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-91109 · Severity: medium · CVSS 6.5 · Published 2026-10-01

The Simply Schedule Appointments WordPress plugin allows authenticated users to expose private appointment tokens and personal information of other appointment participants. An attacker with subscriber access can leak co-bookers' identity tokens and contact details, then use those tokens to read, modify, or cancel other users' appointments, compromising privacy and availability of scheduling data.

Technologies: [Simply Schedule Appointments](https://junglewise.ai/threats/technologies/simply-schedule-appointments). Vendors: [Simply Schedule Appointments](https://junglewise.ai/threats/vendors/simply-schedule-appointments).

## Quick answers

**Is CVE-2026-91109 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91109 being exploited in the wild.

**How severe is CVE-2026-91109?** Medium severity, with a CVSS score of 6.5, published 1 October 2026.

**Which products and versions are affected?** Simply Schedule Appointments up to 1.6.12.31.

**Is there a fix for CVE-2026-91109?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91109 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-91109?** Check whether you run Simply Schedule Appointments at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An Insecure Direct Object Reference (IDOR) vulnerability in the 'complete_group' parameter allows authenticated attackers to bypass access controls on appointment data. The REST controller fails to validate user-controlled keys, enabling disclosure of per-appointment id_token values (as public_token) and PII, and subsequent manipulation of appointment metadata. Exploitation requires a valid id_token for one appointment in the targeted group.

## Affected products

- Simply Schedule Appointments Simply Schedule Appointments up to 1.6.12.31

## Timeline

- 2026-10-01: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-appointment-model.php](https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-appointment-model.php)
- [https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-appointment-model.php](https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.12.27/includes/class-appointment-model.php)

## Related threats

- [Simply Schedule Appointments WordPress plugin sensitive information exposure](https://junglewise.ai/threats/cve-2026-92245-the-simply-schedule-appointments-plugin-for-wordpress-is)
- [Simply Schedule Appointments authorization bypass in appointment purge](https://junglewise.ai/threats/cve-2026-16540-simply-schedule-appointments-authorization-bypass-in-appointment)
- [Simply Schedule Appointments Stored XSS in Booking Customer Information](https://junglewise.ai/threats/cve-2026-13400-simply-schedule-appointments-stored-xss-in-booking-customer)
- [Simply Schedule Appointments WordPress plugin missing authorization in REST API](https://junglewise.ai/threats/cve-2026-6937-simply-schedule-appointments-wordpress-plugin-missing)