What is the CVSS score of CVE-2026-3045?

CVE-2026-3045 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3045?

A high-severity vulnerability in the Simply Schedule Appointments WordPress plugin exposes sensitive appointment data to unauthenticated attackers.

How to fix or mitigate CVE-2026-3045?

Within 24 hours: Audit all WordPress installations to identify use of Simply Schedule Appointments plugin and current version. Within 7 days: Implement WAF rules to block unauthorized access to `/wp-json/ssa/v1/embed-inner` endpoint and disable the plugin if non-critical until patch availability. Within 30 days: Conduct security assessment of exposed data, notify affected customers if required by privacy regulations, and prepare for immediate patching upon vendor release.

WordPress CVE-2026-3045

EUVD-2026-11758 HIGH

Missing Authorization (CWE-862)

2026-03-13 Wordfence

Authentication Bypass Information Disclosure WordPress

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11758

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 07:23 nvd

HIGH 7.5

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound public_nonce is exposed to unauthenticated users through the public /wp-json/ssa/v1/embed-inner REST endpoint, and (2) the get_item() method in SSA_Settings_Api relies on nonce_permissions_check() for authorization (which accepts the public nonce) but does not call remove_unauthorized_settings_for_current_user() to filter restricted fields. This makes it possible for unauthenticated attackers to access admin-only plugin settings including the administrator email, phone number, internal access tokens, notification configurations, and developer settings via the /wp-json/ssa/v1/settings/{section} endpoint. The exposure of appointment tokens also allows an attacker to modify or cancel appointments.

AnalysisAI

High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound public_nonce is exposed to unauthenticated users through the public /wp-json/ssa/v1/embed-inner REST endpoint, and (2) the get_item() method ...

Technical ContextAI

Vulnerability Type: Missing Authorization (CWE-862) CVSS 3.1: 7.5/10.0 — Attack Vector: Network | Complexity: Low | Privileges Required: None | User Interaction: None Attack Techniques: Information Disclosure, Authentication Bypass Source: Wordfence Authentication bypass allows attackers to access protected resources without valid credentials.

RemediationAI

Monitor Wordfence for patches and updates. Reference: https://www.wordfence.com/threat-intel/vulnerabilities/id/5970b8d6-0041-4c30-a6ce-fe67ebf415f5?source=cve