What is the CVSS score of CVE-2026-39495?

CVE-2026-39495 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-39495?

The NSquared Simply Schedule Appointments WordPress plugin (versions ≤1.6.9.27) contains a blind SQL injection vulnerability that allows low-privilege authenticated users to extract sensitive…

How to fix or mitigate CVE-2026-39495?

Within 24 hours: Disable or deactivate the NSquared Simply Schedule Appointments plugin pending remediation; audit user access logs for the affected plugin versions to identify suspicious database queries. Within 7 days: Contact the plugin vendor for patch availability; if unavailable, evaluate alternative scheduling plugins with current security maintenance. Within 30 days: Implement a replacement plugin or apply vendor-released patch immediately upon availability; implement Web Application Firewall (WAF) rules to detect SQL injection patterns targeting the plugin; restrict plugin access to administrators only pending full remediation.

Simply Schedule Appointments CVE-2026-39495

EUVD-2026-20160 HIGH

SQL Injection (CWE-89)

2026-04-08 Patchstack

GHSA-w79w-69fh-fq49

SQLi Simply Schedule Appointments

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 18:22 vuln.today

cvss_changed

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20160

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

HIGH 8.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.

AnalysisAI

Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).

Technical ContextAI

CWE-89 blind SQL injection enabling boolean-based or time-based inference attacks against database queries. CVSS vector PR:L indicates authenticated context; scope change (S:C) suggests attacker can access resources beyond plugin's authorization boundary. Affected CPE: cpe:2.3:a:nsquared:simply_schedule_appointments, confirming WordPress plugin vulnerability in appointment scheduling functionality where SQL queries improperly handle attacker-supplied parameters.

RemediationAI

No vendor-released patch identified at time of analysis. Upstream fix available per Patchstack advisory; released patched version not independently confirmed. Until patched version is released: (1) audit WordPress user permissions to restrict low-privilege authenticated access where feasible, (2) implement Web Application Firewall rules blocking SQL injection patterns in plugin parameters, (3) monitor database query logs for anomalous time-delay patterns indicative of blind SQLi exploitation. Consider temporarily deactivating Simply Schedule Appointments if appointment scheduling functionality is non-critical to operations. Consult Patchstack advisory for technical details: https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-9-27-sql-injection-vulnerability and official NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-39495