What is the CVSS score of CVE-2026-1708?

CVE-2026-1708 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1708?

The Simply Schedule Appointments Booking Plugin contains a critical SQL injection vulnerability affecting all versions up to 1.6.9.27, potentially allowing attackers to extract sensitive customer…

How to fix or mitigate CVE-2026-1708?

Within 24 hours: Inventory all systems running the vulnerable plugin and isolate them from direct internet access if possible; notify affected customers of potential exposure. Within 7 days: Implement Web Application Firewall (WAF) rules to block SQL injection patterns, apply database access controls limiting plugin permissions to read-only operations, and consider disabling the booking functionality until patched. Within 30 days: Evaluate alternative booking solutions, monitor vendor security advisories for patch availability, and conduct forensic analysis to detect any unauthorized database access attempts.

WordPress CVE-2026-1708

HIGH

SQL Injection (CWE-89)

2026-03-11 security@wordfence.com

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 08:16 nvd

HIGH 7.5

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the db_where_conditions method in the TD_DB_Model class failing to prevent the append_where_sql parameter from being passed through JSON request bodies, while only checking for its presence in the $_REQUEST superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the append_where_sql parameter in JSON payloads granted they have obtained a valid public_token that is inadvertently exposed during the booking flow.

AnalysisAI

Simply Schedule Appointments Booking Plugin versions up to 1.6.9.27. is affected by sql injection (CVSS 7.5).

Technical ContextAI

This vulnerability (CWE-89: SQL Injection) affects Simply Schedule Appointments Booking Plugin. The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the db_where_conditions method in the TD_DB_Model class failing to prevent the append_where_sql parameter from being passed through JSON request bodies, while only checking for its presence in the $_REQUEST superglobal. This makes it possible for unauthenticated attackers to append arbitrary

Affected ProductsAI

Product: Simply Schedule Appointments Booking Plugin. Versions: up to 1.6.9.27..

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.