EUVD-2026-20160
GHSA-w79w-69fh-fq49
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSubmit malicious SQL payload in input field
-
ExecutionExecute blind SQL injection query
-
ImpactExtract sensitive data from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires authenticated user access to NSquare Simply Schedule Appointments plugin <= 1.6.9.27. Attacker must be logged-in user with ability to submit crafted input to vulnerable SQL query parameters. No victim interaction needed. |
| Impact | Authenticated SQL injection with high confidentiality impact (CVSS 8.5) affecting a WordPress scheduling plugin. EPSS shows low observed exploitation activity (0.02%). Network-accessible but requires login credentials, limiting blast radius to authenticated users or compromised accounts. Prioritize patching for environments where plugin users have elevated privileges. |
| Exploit ScenarioDerived | Authenticated attacker submits malicious SQL-crafted input through Simply Schedule Appointments form fields, triggering blind SQL injection. Attacker extracts database contents via time-based or boolean-based inference without direct query output visibility. No public exploit code identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Blind SQL injection in NSquared Simply Schedule Appointments WordPress plugin versions ≤1.6.9.27 allows authenticated attackers with low-privilege access to extract sensitive database contents and potentially trigger denial-of-service conditions. The vulnerability stems from improper neutralization of SQL special elements in user-controlled input. Network-accessible exploitation requires valid credentials but no user interaction. CVSS 8.5 severity reflects high confidentiality impact with scope change, enabling cross-boundary data access. No public exploit identified at time of analysis; low observed exploitation activity (EPSS 0.02%, 6th percentile).
RemediationAI
No vendor-released patch identified at time of analysis. Upstream fix available per Patchstack advisory; released patched version not independently confirmed. Until patched version is released: (1) audit WordPress user permissions to restrict low-privilege authenticated access where feasible, (2) implement Web Application Firewall rules blocking SQL injection patterns in plugin parameters, (3) monitor database query logs for anomalous time-delay patterns indicative of blind SQLi exploitation. Consider temporarily deactivating Simply Schedule Appointments if appointment scheduling functionality is non-critical to operations. Consult Patchstack advisory for technical details: https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-9-27-sql-injection-vulnerability and official NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-39495
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89 blind SQL injection enabling boolean-based or time-based inference attacks against database queries. CVSS vector PR:L indicates authenticated context; scope change (S:C) suggests attacker can access resources beyond plugin's authorization boundary. Affected CPE: cpe:2.3:a:nsquared:simply_schedule_appointments, confirming WordPress plugin vulnerability in appointment scheduling functionality where SQL queries improperly handle attacker-supplied parameters.
Know when Simply Schedule Appointments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Blind SQL Injection.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.27.
Executive ViewAI
The NSquared Simply Schedule Appointments WordPress plugin (versions ≤1.6.9.27) contains a blind SQL injection vulnerability that allows low-privilege authenticated users to extract sensitive database contents and cause service disruption. Organizations using this plugin risk exposure of confidential data and potential downtime, particularly if user account creation is enabled or shared among untrusted parties.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Deactivate the plugin immediately; (2) Restrict user account creation and disable low-privilege user access to scheduling functions; (3) Implement database query monitoring and alerting for anomalous SQL patterns; (4) Deploy WAF rules blocking SQL metacharacters in plugin input parameters; (5) Enforce database-level access controls limiting the plugin's service account permissions to minimum required tables.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
More in Simply Schedule Appointments
View allSimply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated us
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user inpu
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject ar
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote a
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauth
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
Exploit-DB