What is the CVSS score of CVE-2026-3658?

CVE-2026-3658 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-3658?

A critical SQL injection vulnerability in the Simply Schedule Appointments booking plugin exposes WordPress sites to unauthorized database access, potentially compromising customer personal…

How to fix or mitigate CVE-2026-3658?

Within 24 hours: Identify all WordPress instances running the affected plugin (versions ≤1.6.10.0) and disable the plugin immediately as a temporary measure. Within 7 days: Assess whether alternative booking solutions can be deployed, audit database access logs for exploitation indicators, and notify stakeholders of potential exposure. Within 30 days: Either migrate to a patched version if released, switch to a secure alternative booking system, or implement robust WAF and database protection controls with continuous monitoring.

WordPress CVE-2026-3658

EUVD-2026-13093 HIGH

SQL Injection (CWE-89)

2026-03-19 Wordfence

WordPress SQLi

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 12:15 euvd

EUVD-2026-13093

Analysis Generated

Mar 19, 2026 - 12:15 vuln.today

CVE Published

Mar 19, 2026 - 11:15 nvd

HIGH 7.5

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, including usernames, email addresses, and password hashes.

AnalysisAI

Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.

Technical ContextAI

This vulnerability affects the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, identified by CPE cpe:2.3:a:croixhaug:appointment_booking_calendar_—_simply_schedule_appointments_booking_plugin. The root cause is CWE-89 (SQL Injection), stemming from inadequate input validation and parameterization in the plugin's database query construction. Based on the references to the WordPress plugin repository, the vulnerable code paths include class-td-db-model.php (line 1171), class-td-api-model.php (line 140), and class-appointment-type-model.php (line 907), where the 'fields' parameter is processed without proper escaping or prepared statement usage. This allows attackers to inject malicious SQL commands that are executed against the WordPress database, enabling unauthorized data access through boolean-based blind SQL injection or UNION-based techniques.

RemediationAI

Update the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin to a version newer than 1.6.10.0 that includes the security fix referenced in changeset 3485143, available at https://plugins.trac.wordpress.org/changeset/3485143/. WordPress administrators should immediately check their installed version through the WordPress admin dashboard under Plugins and apply available updates. Until patching is completed, consider temporarily disabling the plugin if appointment booking functionality is not business-critical, or implement web application firewall (WAF) rules to filter suspicious SQL injection patterns in the 'fields' parameter. Review WordPress database user permissions to ensure the principle of least privilege is enforced, limiting potential data exposure. After patching, review database logs for any suspicious query activity that may indicate prior exploitation attempts and consider forcing password resets for administrative accounts if compromise is suspected.