Simply Schedule Appointments CVE-2026-6937

Exploitation requires that the target site has Simply Schedule Appointments version 1.6.11.8 or earlier installed and active, and that at least one publicly accessible page on the site renders the [ssa_booking] shortcode - this is the mechanism through which the static nonce is delivered to anonymous visitors. The attacker must perform one anonymous page load to retrieve the nonce from the HTML source before issuing API calls. The CVSS PR:N vector confirms no authentication is required. Exploitation is blocked or significantly limited if: (1) the booking shortcode is present only on password-protected or logged-in-only pages, preventing nonce exposure to unauthenticated visitors; (2) the site has no appointments in the system yet; or (3) a WAF blocks access to the bulk REST endpoint. Sites using the plugin solely in admin-side contexts without any public shortcode rendering are not exposed to anonymous nonce extraction.

The CVSS 5.3 Medium score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) understates real-world risk in a significant way: the vector assigns C:N (no confidentiality impact), yet the CVE description explicitly states that the bulk endpoint response exposes full customer PII including names and contact information. This is a notable conflict between the CVSS score and the described impact that should be verified against the Wordfence advisory. If PII disclosure is confirmed, the effective confidentiality impact elevates this beyond a simple integrity-only finding. The AC:L/PR:N/UI:N combination confirms the attack is low-complexity, requires no privileges, and no victim interaction - a practical one-step exploit for any visitor who has seen a booking page. The static nonce design flaw means the attack is also persistent: the nonce does not rotate per session or expire, so a nonce collected once remains valid indefinitely until the plugin is patched. No EPSS data was provided. No KEV listing and no public POC are identified, but the trivial exploitation path (single HTTP request with a nonce from page source) means real-world exploitation barrier is very low for any site running a public booking page.

An attacker visits any public-facing page on a target WordPress site that displays an appointment booking widget rendered by the [ssa_booking] shortcode. They inspect the page HTML source and extract the static nonce value. Using that nonce, they issue unauthenticated HTTP requests to the bulk appointments REST API endpoint - first to enumerate all existing appointment records and harvest customer PII (names, emails, phone numbers), then to overwrite meeting URL fields across selected appointments with attacker-controlled URLs, redirecting victims to phishing pages or malicious video call links.