Simply Schedule Appointments CVE-2026-39493

Target site must have the Simply Schedule Appointments WordPress plugin installed and activated at version 1.6.9.27 or earlier, with the vulnerable booking/REST endpoint reachable over the network (default for any public WordPress site exposing wp-json or admin-ajax.php). No authentication, user interaction, or non-default configuration is required per CVSS PR:N/UI:N. Practical limits: a WAF with SQLi signatures or virtual patching rule may block trivial payloads, and the I:N portion of the CVSS vector suggests the vulnerable query path may not support data modification, so impact is primarily data disclosure rather than database tampering.

Signals are mixed but lean toward priority remediation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) confirms a network-reachable, unauthenticated, low-complexity attack with scope change and high confidentiality impact - classic profile for mass scanning of WordPress sites. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be cited. The vulnerability is NOT listed in CISA KEV and no public PoC reference was supplied, so this is not yet confirmed actively exploited; however, Patchstack disclosure of WordPress plugin SQLi historically correlates with rapid weaponization once details are public. Note also a vector anomaly worth flagging: I:N (no integrity impact) is unusual for SQL injection - most SQLi permits UPDATE/INSERT/DELETE - suggesting the vulnerable code path may be read-only (e.g., SELECT-only context); defenders should not assume integrity is safe without vendor confirmation.

An unauthenticated attacker sends a crafted HTTP request to a Simply Schedule Appointments REST or AJAX endpoint with malicious SQL syntax injected into a parameter (for example, an appointment query or filter parameter). The injected SQL is executed against the WordPress database, allowing the attacker to exfiltrate sensitive data such as wp_users hashes, secret keys, customer PII from booking tables, or session/nonce data, enabling follow-on account takeover of WordPress administrators.