What is the CVSS score of CVE-2026-65508?

CVE-2026-65508 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-65508?

Simply Schedule Appointments WordPress plugin versions 1.6.12.10 and earlier contain a critical vulnerability allowing unauthenticated, remote attackers to directly access and extract the entire…

How to fix or mitigate CVE-2026-65508?

Within 24 hours, audit all WordPress installations to identify those running Simply Schedule Appointments plugin version 1.6.12.10 or earlier and prioritize production environments for immediate action. Within 7 days, deactivate and completely remove the plugin from all affected WordPress instances, enable comprehensive database access logging to detect any suspicious queries dating back to vulnerability disclosure, and review database user privileges to confirm least-privilege configuration. Within 30 days, deploy a replacement scheduling solution from a vetted alternative plugin, conduct a forensic database security audit to confirm no unauthorized data extraction occurred, implement network-layer SQL injection protection via Web Application Firewall (WAF) rules, and restrict database network access to application servers only.

Simply Schedule Appointments CVE-2026-65508

EUVD-2026-53964 CRITICAL

SQL Injection (CWE-89)

2026-08-06 Patchstack

GHSA-8prr-j8xh-jjcw

WordPress SQLi Simply Schedule Appointments Wordpress Plugin Nsquared

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

7.5 HIGH

Unauthenticated remote SQLi over the network is AV:N/AC:L/PR:N/UI:N with C:H for database reads; integrity/availability set to N as the source asserts read-only impact and no scope change is evidenced.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:26 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.12.10 versions.

AnalysisAI

Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) lets remote attackers inject arbitrary SQL through the plugin's appointment/booking request handling, exposing the underlying WordPress database without any login. Because the CVSS vector is PR:N/UI:N with a scope change (S:C) and high confidentiality impact, any WordPress site running a vulnerable version is reachable over the network by anonymous users. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL Injection: user-controlled input reaches a database query without proper parameterization or sanitization. The affected component is the nsquared 'Simply Schedule Appointments' plugin for WordPress (CPE cpe:2.3:a:nsquared:simply_schedule_appointments), a scheduling/booking plugin that exposes AJAX/REST endpoints to unauthenticated visitors so they can view availability and submit bookings. Those public-facing endpoints are the natural attack surface for an unauthenticated SQLi, where a crafted parameter is concatenated into a SQL statement executed against the WordPress MySQL/MariaDB backend, allowing extraction of arbitrary table data (users, password hashes, secrets).

RemediationAI

Update the Simply Schedule Appointments plugin to a release newer than 1.6.12.10 as soon as the vendor's patched version is confirmed on the WordPress plugin repository or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-10-sql-injection-vulnerability) - no exact fix version was provided in the input, so verify the target version against the vendor changelog before deploying. Until a patched build is applied, put a WAF or virtual patch in front of the site to block SQL-injection payloads on the plugin's public AJAX/REST booking endpoints (Patchstack and comparable WAFs ship rules for this), and if the booking feature is not business-critical, deactivate the plugin to remove the exposed endpoints entirely - the trade-off being loss of online scheduling functionality. As defense in depth, restrict the WordPress database account's privileges to the minimum required, but note that alone does not stop data exfiltration via read-based SQLi.