[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgIapT9RsNe4uqIW_xlJSFmplXOo9AEjbkWnhhgIC8As":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-59523","appointment-booking-calendar-simply-schedule-appointments-booking-plugin-missing-authorization-2","Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \u003C= 1.6.11.11 - Missing Authorization","The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.6.11.11. This makes it possible for unauthenticated attackers to perform an unauthorized action.","simply-schedule-appointments",null,"\u003C=1.6.11.11","1.6.12.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-07-09 00:00:00","2026-07-14 19:35:41",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F8f906e8c-0b20-4da7-86b8-3306f36c46a4?source=api-prod",6,[22,23,24,25,26,27,28,29],"CHANGELOG.md","includes\u002Fclass-appointment-meta-model.php","includes\u002Fclass-appointment-model.php","includes\u002Fclass-appointment-type-model.php","includes\u002Fclass-db-model.php","includes\u002Fclass-elementor.php","includes\u002Fclass-embed-booking-app-api.php","includes\u002Fclass-notices-api.php","researched",false,3,"Notices_Api` routes use `get_items_permissions_check`.\n    If this function is NOT defined in `SSA_Notices_Api` and NOT in `WP_REST_Controller`, what happens?\n    WordPress will try to call it and fail if it doesn't exist.\n    However, the class `SSA_Notices_Api` is truncated. It *likely* contains:\n    ```php\n    public function get_items_permissions_check( $request ) {\n        return true;\n    }\n    ```\n    This would be the \"Missing Authorization\" (it exists, but it doesn't authorize).\n\n    Let's look at `SSA_Notices_Api::update_item`:\n    ```php\n    public function update_item( $request ) {\n        $params = $request->get_params();\n        $notice_name = sanitize_text_field( $params['id'] );\n        \u002F\u002F ...\n        update_option( 'ssa_dismissed_notices', $dismissed_notices, false );\n    }\n    ```\n    It's a perfect sink.\n\n    1. Summary\n    2. Attack Vector: `POST \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices\u002Fpinned\u002F`\n    3. Code Flow: `SSA_Db_Model::whitelist_ssa_rest_api` -> `SSA_Notices_Api::update_item_pinned_notices`.\n    4. Nonce: Explain why it'","The Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access and modification of administrative notice settings due to improper permission checks and a global REST API authentication bypass. Unauthenticated or low-privileged attackers can trigger REST endpoints to dismiss or pin administrative notices site-wide, as the plugin whitelists all \u002Fssa\u002F routes from core WordPress REST authentication.","\u002F\u002F includes\u002Fclass-db-model.php line 31\npublic function whitelist_ssa_rest_api( $result ) {\n\tif ( isset( $GLOBALS['wp']->query_vars['rest_route'] ) ) {\n\t\t$route = untrailingslashit( $GLOBALS['wp']->query_vars['rest_route'] );\n\t\tif ( 0 === strpos( $route, '\u002Fssa\u002F' ) ) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn $result;\n}\n\n---\n\n\u002F\u002F includes\u002Fclass-notices-api.php line 308\npublic function get_items_permissions_check( $request ) {\n\treturn TD_API_Model::nonce_permissions_check( $request );\n}\n\n\u002F\u002F includes\u002Fclass-notices-api.php line 320\npublic function update_item_permissions_check( $request ) {\n\tif ( is_user_logged_in() ) {\n\t\treturn true;\n\t}\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimply-schedule-appointments\u002F1.6.11.11\u002Fincludes\u002Fclass-notices-api.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimply-schedule-appointments\u002F1.6.12.0\u002Fincludes\u002Fclass-notices-api.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimply-schedule-appointments\u002F1.6.11.11\u002Fincludes\u002Fclass-notices-api.php\t2024-02-20 19:37:14.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Fsimply-schedule-appointments\u002F1.6.12.0\u002Fincludes\u002Fclass-notices-api.php\t2026-06-05 10:42:28.000000000 +0000\n@@ -302,47 +302,39 @@\n \t}\n \n \t\u002F**\n-\t * Check if a given request has access to get items\n+\t * Plugin admin notices and dismissed\u002Fpinned state are admin UI surface, not\n+\t * public-facing data, and reads\u002Fwrites affect site-wide options. Gate every\n+\t * notices route on the SSA admin floor (`ssa_manage_appointments`).\n \t *\n \t * @param WP_REST_Request $request Full data about the request.\n-\t * @return WP_Error|bool\n+\t * @return bool\n \t *\u002F\n \tpublic function get_items_permissions_check( $request ) {\n-\t\treturn TD_API_Model::nonce_permissions_check( $request );\n+\t\treturn current_user_can( 'ssa_manage_appointments' );\n \t}\n \n \t\u002F**\n-\t * Check if a given request has access to get a specific item\n-\t *\n \t * @param WP_REST_Request $request Full data about the request.\n-\t * @return WP_Error|bool\n+\t * @return bool\n \t *\u002F\n \tpublic function get_item_permissions_check( $request ) {\n-\t\treturn TD_API_Model::nonce_permissions_check( $request );\n+\t\treturn current_user_can( 'ssa_manage_appointments' );\n \t}\n \n \t\u002F**\n-\t * Check if a given request has access to update a specific item\n-\t *\n \t * @param WP_REST_Request $request Full data about the request.\n-\t * @return WP_Error|bool\n+\t * @return bool\n \t *\u002F\n \tpublic function update_item_permissions_check( $request ) {\n-\t\tif ( is_user_logged_in() ) {\n-\t\t\treturn true;\n-\t\t}\n+\t\treturn current_user_can( 'ssa_manage_appointments' );\n \t}\n \n \t\u002F**\n-\t * Check if a given request has access to delete a specific item\n-\t *\n \t * @param WP_REST_Request $request Full data about the request.\n-\t * @return WP_Error|bool\n+\t * @return bool\n \t *\u002F\n \tpublic function delete_item_permissions_check( $request ) {\n-\t\tif ( is_user_logged_in() ) {\n-\t\t\treturn true;\n-\t\t}\n+\t\treturn current_user_can( 'ssa_manage_appointments' );\n \t}","1. An attacker identifies a REST API endpoint belonging to the notices functionality, such as POST \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices\u002Fpinned\u002F{id} or POST \u002Fwp-json\u002Fssa\u002Fv1\u002Fnotices\u002F{id}.\n2. The attacker sends a request to this endpoint without valid administrative credentials or a valid nonce.\n3. The plugin's global whitelist in SSA_Db_Model::whitelist_ssa_rest_api instructs WordPress to bypass standard REST authentication for this route.\n4. The vulnerable permission_callback in SSA_Notices_Api (either get_items_permissions_check or update_item_permissions_check) fails to adequately verify administrative capabilities, checking only for basic login or a weak legacy nonce condition.\n5. Upon successful request, the plugin executes update_option(), allowing the attacker to modify site-wide settings such as ssa_dismissed_notices or ssa_pinned_notices.","gemini-3-flash-preview","2026-07-15 22:06:25","2026-07-15 22:07:16",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","1.6.11.11","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.11.11","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.11.11.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags\u002F1.6.12.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fsimply-schedule-appointments.1.6.12.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fsimply-schedule-appointments\u002Ftags"]