What is the CVSS score of CVE-2026-57812?

CVE-2026-57812 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Simply Schedule Appointments CVE-2026-57812

EUVD-2026-43424 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Simply Schedule Appointments Wordpress Plugin Nsquared

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint with no user interaction; integrity and availability impacts limited to appointment data, no confidentiality breach.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:18 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.12.4.

AnalysisAI

Unauthenticated broken access control in the Simply Schedule Appointments WordPress plugin (versions through 1.6.12.4) allows remote attackers to perform unauthorized actions against appointment data, resulting in low-integrity and low-availability impacts. The plugin by NSquared fails to enforce proper authorization checks on one or more endpoints, enabling exploitation without any credentials against default installations. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the low attack complexity and zero privilege requirement lower the barrier for opportunistic abuse.

Technical ContextAI

Simply Schedule Appointments (CPE: cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:*:*:*) is a WordPress plugin providing appointment booking and calendar management functionality. The root cause is CWE-862 (Missing Authorization), a class of flaw where server-side code performs a sensitive operation - such as creating, modifying, or canceling appointments - without verifying that the requesting party holds the necessary role or capability. In WordPress, this typically manifests as AJAX handlers or REST API endpoints registered without capability checks (e.g., missing current_user_can() calls or nonce/role validation). The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the flaw is reachable over HTTP without credentials or user interaction, placing it in the category of externally exploitable broken access control as described by OWASP A01:2021.

RemediationAI

Update Simply Schedule Appointments to the first release published after version 1.6.12.4 - the exact patched version number is not confirmed in the available data (patch available per vendor/Patchstack advisory; released patched version not independently verified). Site administrators should check the WordPress plugin repository or https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/ for the current safe release and apply it immediately. If upgrading is temporarily not possible, a compensating control is to restrict access to WordPress AJAX and REST API endpoints at the web server or WAF layer for unauthenticated requests, though this may break legitimate front-end booking functionality. Alternatively, placing the site behind authentication (e.g., HTTP Basic Auth at the web server level) for anonymous visitors would eliminate the unauthenticated attack surface, at the cost of blocking public booking access. Monitoring WordPress access logs for anomalous POST requests to wp-admin/admin-ajax.php or /wp-json/ from unexpected IPs can aid in detecting exploitation attempts.