What is the CVSS score of CVE-2026-59523?

CVE-2026-59523 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Simply Schedule Appointments CVE-2026-59523

EUVD-2026-43434 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Simply Schedule Appointments Wordpress Plugin Nsquared

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable plugin endpoint with no auth required (PR:N), low complexity; partial C and I impact only, no availability impact per description.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:17 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.11.11.

AnalysisAI

Missing Authorization in NSquared's Simply Schedule Appointments WordPress plugin (versions through 1.6.11.11) allows unauthenticated network attackers to bypass access control security levels, yielding limited confidentiality and integrity impact against affected WordPress sites. Reported by Patchstack under CWE-862, the flaw is automatable per CISA's SSVC framework, meaning it can be exploited at scale without human interaction. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but the unauthenticated, low-complexity attack surface warrants prompt patching.

Technical ContextAI

The affected product is the Simply Schedule Appointments WordPress plugin by NSquared, identified by CPE cpe:2.3:a:nsquared:simply_schedule_appointments:*:*:*:*:*:*:*:*. The root cause is CWE-862 (Missing Authorization), a class of vulnerability where server-side code fails to verify that the requesting party holds the required permissions before performing a privileged action. In WordPress, this typically manifests as a REST API endpoint or AJAX handler that does not call capability checks (e.g., current_user_can()) before executing sensitive operations. The 'Exploiting Incorrectly Configured Access Control Security Levels' framing from the description indicates that the plugin's internal role or permission tiers can be bypassed, allowing lower-privileged or anonymous users to invoke functionality intended for higher-privileged roles such as administrators or editors.

RemediationAI

Update the Simply Schedule Appointments plugin to a version beyond 1.6.11.11 via the WordPress admin dashboard (Plugins > Installed Plugins > Update). The exact patched release version was not independently confirmed in the available data - verify the current version in the WordPress Plugin Directory or the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-11-11-broken-access-control-vulnerability before deploying. If an immediate update is not feasible, a compensating control is to deactivate the Simply Schedule Appointments plugin until a patch can be applied - deactivation eliminates the attack surface entirely but removes appointment scheduling functionality. Alternatively, a web application firewall (WAF) with WordPress-aware rulesets (e.g., Patchstack, Wordfence, or Cloudflare managed rulesets) may block exploitation of broken access control patterns, though this should not be treated as a permanent substitute for patching.