What is the CVSS score of CVE-2026-42384?

CVE-2026-42384 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-42384?

The Simply Schedule Appointments WordPress plugin (versions before 1.6.11.2) permits remote actors to access sensitive appointment and scheduling data without authentication.. A patch is available.

How to fix or mitigate CVE-2026-42384?

Within 24 hours: Inventory all WordPress deployments and identify Simply Schedule Appointments installations with their current versions. Within 7 days: Deploy patch to version 1.6.11.2 across all affected systems. Within 30 days: Complete post-patch verification, review logs for unauthorized access attempts, and document remediation.

Simply Schedule Appointments CVE-2026-42384

EUVD-2026-36812 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-15 Patchstack

GHSA-vxmf-3r42-mv9x

WordPress Information Disclosure Simply Schedule Appointments Wordpress Plugin Nsquared

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Description explicitly states unauthenticated remote sensitive data exposure, so AV:N/AC:L/PR:N/UI:N with C:H and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 22:04 vuln.today

Patch available

Jun 15, 2026 - 22:02 EUVD

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

AnalysisAI

Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Simply Schedule Appointments is a WordPress appointment-booking plugin published by nsquared (CPE cpe:2.3:a:nsquared:simply_schedule_appointments). The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin returns data via an exposed surface - typically a REST/AJAX endpoint reachable from the WordPress front end - that should have been restricted to authenticated or privileged callers. Because WordPress plugins commonly expose /wp-json/ REST routes, a missing permission_callback or weak capability check is the typical mechanism behind this CWE in this ecosystem, allowing data intended for booking administrators or scheduled attendees to leak to anonymous requesters.

RemediationAI

Patch available per vendor advisory - upgrade the Simply Schedule Appointments plugin to version 1.6.11.2 or later via the WordPress plugin updater, and confirm details on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-11-2-sensitive-data-exposure-vulnerability. If immediate patching is not possible, deactivate the plugin (side effect: appointment booking functionality is lost) or place the site behind a WAF / virtual patch (Patchstack, Wordfence) with a rule blocking anonymous requests to the plugin's REST/AJAX endpoints under /wp-json/ssa/ and admin-ajax.php?action=ssa_* (side effect: legitimate unauthenticated booking flows may break and require testing). Restricting access to the WordPress REST API for unauthenticated users is an additional compensating control but will impact any other plugin that relies on public REST routes.