Unauthenticated appointment disclosure and deletion via recursive reads

Information disclosure in Simply Schedule Appointments 1.6.12.32 and earlier lets remote attackers read customer records through a REST endpoint. The appointment_types REST handler accepts a public nonce and uses the recursive parameter to return appointment rows, including customer details and public_token values, without an appointment-level read boundary. No login is needed; an exposed token also authorizes deletion of its appointment through the appointments DELETE route.