What is the CVSS score of CVE-2026-39493?

CVE-2026-39493 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.4%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-39493?

Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) contains a critical unauthenticated SQL injection vulnerability with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-39493?

Within 24 hours: Identify all WordPress installations running Simply Schedule Appointments plugin version 1.6.9.27 or earlier. Within 7 days: Disable the plugin if non-critical, or deploy Web Application Firewall rules to block SQL injection patterns; restrict plugin endpoint access via IP whitelisting and network segmentation. Within 30 days: Monitor vendor security advisories for patch release; conduct database audit for unauthorized access; evaluate alternative appointment scheduling solutions.

Simply Schedule Appointments CVE-2026-39493

EUVD-2026-36944 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-87gp-c4mf-v6pp

WordPress SQLi Simply Schedule Appointments Wordpress Plugin Nsquared

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.3 CRITICAL

Unauthenticated network SQLi (AV:N/AC:L/PR:N/UI:N) against a plugin reading the shared WP database is scope change with high confidentiality; SQLi typically allows at least limited integrity impact, so I:L rather than I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:26 vuln.today

DescriptionCVE.org

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

AnalysisAI

Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote attackers to inject crafted SQL through plugin endpoints without authentication. The flaw carries a CVSS 3.1 score of 9.3 with scope change, indicating impact beyond the vulnerable component, though only confidentiality (High) and availability (Low) are affected per the vector. No public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Simply Schedule Appointments is an appointment-booking plugin for WordPress (vendor: nsquared, CPE cpe:2.3:a:nsquared:simply_schedule_appointments) used by site operators to manage scheduling forms and customer bookings. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into SQL queries without proper parameterization or escaping. In WordPress plugin context this typically arises when REST/AJAX endpoints accept booking, calendar, or query parameters and pass them into $wpdb queries without using $wpdb->prepare(), allowing attacker-supplied SQL syntax to alter query semantics against the WordPress database.

RemediationAI

Upgrade the Simply Schedule Appointments plugin to a version newer than 1.6.9.27 as soon as the vendor publishes a patched release; consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-9-27-sql-injection-vulnerability-2) for the exact fixed version, as a specific patched version was not enumerated in the available input data. Until a fix is applied, deactivate and remove the plugin if appointment booking is not business-critical (side effect: removes booking functionality from the site); alternatively, place the site behind a WordPress-aware WAF such as Patchstack, Wordfence, or Cloudflare with virtual patching rules for this CVE (side effect: WAF false positives may block legitimate booking submissions), and restrict access to /wp-json/ssa/* and /wp-admin/admin-ajax.php actions associated with the plugin via IP allowlist where feasible. Audit wp_options, user, and ssa_* database tables for signs of prior probing before patching.