EUVD-2026-20391
GHSA-p542-f77w-p389
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | Risk signals present a complex but ultimately low-priority picture. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible, unauthenticated exploitation with low complexity, superficially supporting urgency. However, EPSS probability of 0.02% (4th percentile) suggests minimal real-world exploitation likelihood-placing this in the bottom 5% of vulnerability risk distribution. The SSVC framework reinforces this: exploitation status is 'none,' technical impact is 'partial' (confidentiality only, no integrity or availability impact), and while the issue is automatable, the combination yields low priority. The confidentiality impact (C:L) is limited to reading certain data. No KEV confirmation, no POC, and low EPSS together indicate this is a classic example of a moderate-CVSS-but-genuinely-low-risk vulnerability driven by attack complexity and limited actual impact. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted HTTP request to the Simply Schedule Appointments plugin's API endpoint (likely a REST API route or AJAX handler) to retrieve restricted scheduling data, customer information, or configuration details. Due to missing authorization checks, the plugin returns the requested data without validating the requester's credentials or role. No user interaction or special complexity is required; the attack is fully automated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Missing authorization in NSquared Simply Schedule Appointments WordPress plugin through version 1.6.10.2 allows unauthenticated remote attackers to read sensitive information by exploiting incorrectly configured access control security levels. The vulnerability has a CVSS score of 5.3 (low-moderate) and EPSS probability of 0.02%, placing it in the lower-risk percentile despite public awareness. No active exploitation has been confirmed, and SSVC decision data indicates the issue is automatable but non-critical due to partial technical impact.
RemediationAI
Update Simply Schedule Appointments to a version newer than 1.6.10.2 as soon as a patch is released by NSquared. Because the exact patched version number is not confirmed in the provided data, administrators should monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-10-2-broken-access-control-vulnerability) and the plugin's official WordPress repository for version 1.6.10.3 or later. As an interim measure, review and tighten WordPress capability assignments for users accessing the affected plugin, and restrict direct API calls to the plugin's endpoints using web application firewalling if available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the NSquared Simply Schedule Appointments WordPress plugin (CPE: cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:*:*:*), classified as CWE-862 (Missing Authorization). This root cause indicates the plugin fails to enforce proper authorization checks on certain functionality, likely API endpoints or admin features. The access control misconfiguration allows unauthenticated users to bypass permission validation layers. As a WordPress plugin, the vulnerability likely affects the REST API or AJAX handlers that should restrict access based on user roles or capabilities but instead expose read-only data due to missing or improperly implemented authorization logic.
Know when Simply Schedule Appointments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.10.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simply Schedule Appointments
View allSimply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated us
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user inpu
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject ar
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote a
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauth
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
Exploit-DB