Simply Schedule Appointments CVE-2026-6723

Exploitation requires reaching the appointment-update REST API endpoint of the Simply Schedule Appointments plugin while possessing a valid per-appointment token (the token issued to a booking customer); with such a token the attacker can set admin-only fields the endpoint does not restrict. The limiting factor is that this is a logic/authorization flaw confined to appointment records - it grants no server access, no data disclosure, and no code execution, and it is only impactful on sites that rely on the plugin's payment-confirmation or service-assignment fields (e.g. paid bookings). It affects all versions up to and including 1.6.11.11 in default configuration.

This is a moderate, business-logic authorization flaw, not a system-compromise bug. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) correctly captures the shape: network-reachable, low complexity, no confidentiality or availability impact, and only LOW integrity impact - the attacker can tamper with specific appointment fields but cannot read data or take down the host. There is a nuance worth flagging: the CVSS scores this PR:N (unauthenticated) while the description says the vulnerable endpoint serves 'token-authenticated customers' - reconciled, this means the attacker needs a valid per-appointment token rather than a WordPress account, which Wordfence reasonably treats as effectively unauthenticated for scoring. No EPSS score was provided, and there is no CISA KEV listing and no public POC in the supplied data, so there is no evidence of active or at-scale exploitation. The impact is real but narrow (payment-confirmation spoofing, appointment reassignment, service-type changes), making this a prioritize-for-patching-in-normal-cycle issue rather than an emergency, especially for sites that process paid bookings through this plugin.

An attacker who holds or obtains a valid appointment token sends a crafted request to the appointment-update REST API endpoint and includes admin-controlled fields that the endpoint fails to restrict. They flip the payment status to 'confirmed' on an unpaid booking, or reassign the appointment and change its service type. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) and lack of a privileged account make it straightforward to script against a known booking.