Simply Schedule Appointments CVE-2026-59523

The vulnerability is exploitable against any WordPress installation running Simply Schedule Appointments version 1.6.11.11 or earlier where the plugin is active. The CVSS vector PR:N/UI:N/AC:L indicates no authentication, no user interaction, and no special configuration is required beyond the plugin being installed and active. What limits exploitation is the partial impact scope - attackers gain only limited confidentiality and integrity access (C:L/I:L) rather than full control, and the affected functionality is bounded to the plugin's appointment scheduling features rather than the broader WordPress instance. There is no indication from available data that exploitation requires a specific sub-feature to be enabled or a non-default configuration - the missing authorization check appears to apply to the plugin in its default installed state.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) scores 6.5 (Medium), indicating network-reachable, low-complexity, unauthenticated exploitation with partial confidentiality and integrity impact and no availability impact. The SSVC assessment reinforces automation risk - Automatable: yes means adversaries can script mass exploitation across WordPress installations without per-target interaction. However, Technical Impact is rated partial, and Exploitation status is none, meaning no active exploitation has been observed by CISA. The combination of an unauthenticated attack vector with automation potential elevates practical risk above what a standalone Medium CVSS score might suggest for widely-installed WordPress plugins. The absence of KEV listing and POC code moderates immediate urgency but does not diminish the need to patch, given how frequently WordPress plugin vulnerabilities are mass-scanned.

An unauthenticated remote attacker sends crafted HTTP requests to a vulnerable Simply Schedule Appointments endpoint on a WordPress site running version 1.6.11.11 or earlier, bypassing the plugin's access control checks to read appointment data or modify scheduling records that should require elevated privileges. No public exploit code has been identified at time of analysis, but the low attack complexity and SSVC Automatable: yes rating indicate that automated scanning tools could trivially probe and exploit this at scale across WordPress installations. The limited C:L/I:L impact suggests the attacker gains partial visibility into or manipulation of appointment data rather than full administrative control.