EUVD-2026-32739
GHSA-8h7g-4m22-x8gv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin
-
DeliveryScrape page to harvest ssa.api.public_nonce
-
ExploitSend PUT to /appointments/bulk with form-encoded body
-
ExecutionInject time-based payload via append_where_sql
-
PersistBypass blocklist via unpopulated superglobals
-
ImpactBlind-exfiltrate credentials and PII from database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication required - the /appointments/bulk REST endpoint's permission check accepts the ssa.api.public_nonce that is embedded in the booking widget's frontend JavaScript and therefore readable by any unauthenticated visitor of any page that loads the widget. Exploitation requires three specific conditions: (1) the target site must have the Simply Schedule Appointments plugin installed at version <= 1.6.11.8 and active, (2) the booking widget must be rendered on at least one publicly accessible page so the public nonce can be harvested, and (3) the attacker must send the request as an HTTP PUT with a Content-Type of application/x-www-form-urlencoded so PHP does not populate the superglobals that the plugin's blocklist inspects - a standard POST or a PUT with application/json will be filtered. No user interaction or non-default configuration beyond having the plugin installed is required. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N) is consistent with the description: network-reachable, no authentication, no user interaction, high confidentiality impact only - appropriate for blind SQLi that exfiltrates data without modifying it. EPSS, KEV status, and POC availability are not provided in the input, so real-world exploitation pressure cannot be quantified from the available data. The bar to exploit is genuinely low - the public nonce is harvestable from any unauthenticated page load that renders the booking widget, and the PUT-with-form-encoded-body trick is straightforward to script - so this should be treated as high-priority for any site running the plugin, especially given WordPress plugin vulnerabilities historically see rapid mass-exploitation by automated scanners regardless of initial EPSS scores. |
| Exploit ScenarioDerived | An unauthenticated attacker scrapes the public booking widget page to harvest the ssa.api.public_nonce value, then issues a PUT request with Content-Type application/x-www-form-urlencoded to /wp-json/ssa/v1/appointments/bulk containing a malicious 'append_where_sql' payload using time-based conditions (e.g., SLEEP) to blind-extract WordPress admin credentials, API tokens, or customer PII from the wp_users and plugin-managed appointment tables. No public exploit code is identified at time of analysis, but the Wordfence writeup describes the technique in sufficient detail that scripted exploitation is straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.
RemediationAI
Upstream fix available (changeset 3549843 against tag 1.6.11.9); the patched release should be applied by upgrading the Simply Schedule Appointments plugin to version 1.6.11.9 or later via the WordPress admin plugins screen, with the changeset visible at https://plugins.trac.wordpress.org/changeset/3549843/simply-schedule-appointments/tags/1.6.11.9/includes/lib/td-util/class-td-db-model.php. If immediate patching is not possible, compensating controls include blocking PUT requests to /wp-json/ssa/v1/appointments/bulk at the WAF or reverse proxy (side effect: any legitimate plugin features relying on PUT to that endpoint will break), restricting access to /wp-json/ssa/* to known booking-form referrers or IPs (side effect: may block legitimate bookings from unexpected networks), or temporarily deactivating the plugin until upgrade - the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/db3bddbd-44b0-4105-9039-0d669d643481 should be consulted for any vendor-specific virtual-patch rules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-89 SQL Injection rooted in insufficient escaping and lack of prepared statements in the plugin's database access layer (class-td-db-model.php around line 1049) and REST API model (class-td-api-model.php lines 304 and 361). The 'append_where_sql' parameter is concatenated into an existing query rather than passed through wpdb::prepare(), allowing attackers to append arbitrary SQL fragments. The bypass leverages two WordPress and PHP behaviors: first, that public nonces intended for frontend widgets (ssa.api.public_nonce) are exposed to every site visitor in page HTML/JS, and second, that PHP only populates $_POST when the Content-Type matches form-encoded data on POST requests - by using PUT with application/x-www-form-urlencoded, the blocklist check that scans superglobals silently passes while the raw body still reaches the vulnerable handler.
Know when Appointment Booking Calendar Simply Schedule Appointments Booking Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in all versions up to, and including, 1.6.11.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The /appointments/bulk REST endpoint is reachable by unauthenticated attackers because its permission check accepts a public nonce that is embedded in the booking widget's frontend JavaScript (ssa.api.public_nonce) and visible to all site visitors; exploitation requires issuing the request as a PUT with an application/x-www-form-urlencoded body so that PHP's superglobals are not populated and the blocklist check silently passes.
Executive ViewAI
Simply Schedule Appointments WordPress plugin (versions up to 1.6.11.8) contains an unauthenticated SQL injection vulnerability allowing remote attackers to extract sensitive database contents. No public exploit identified at time of analysis. Organizations using this plugin risk exposure of customer appointment data, payment information, and other sensitive records stored in their WordPress database.
No vendor-released patch identified at time of analysis. Interim mitigations: deploy Web Application Firewall (WAF) rules to block requests to /appointments/bulk containing SQL syntax; restrict the REST endpoint to whitelisted IP addresses if operationally feasible; isolate affected WordPress instances; enable database query logging and alerting for anomalous patterns; strongly recommend uninstalling the plugin until a vendor patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (ve
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simpl
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delet
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all v
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Ap
Exploit-DB