What is the CVSS score of CVE-2026-7797?

CVE-2026-7797 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Simply Schedule Appointments are affected by CVE-2026-7797?

Simply Schedule Appointments WordPress plugin (versions up to 1.6.11.8) contains an unauthenticated SQL injection vulnerability allowing remote attackers to extract sensitive database contents.

How to fix or mitigate CVE-2026-7797?

WITHIN 24 HOURS: Inventory all WordPress installations running Simply Schedule Appointments version 1.6.11.8 or earlier; immediately disable the plugin and restrict network access to the /appointments/bulk REST endpoint. WITHIN 7 DAYS: Uninstall the vulnerable plugin version entirely; migrate to an alternative scheduling solution; verify complete removal through file system and database audits. WITHIN 30 DAYS: Monitor the plugin vendor for security patch release; when available, test and deploy the patch to any remaining instances; implement automated plugin update processes.

Simply Schedule Appointments CVE-2026-7797

EUVD-2026-32739 HIGH

SQL Injection (CWE-89)

2026-05-28 Wordfence

GHSA-8h7g-4m22-x8gv

WordPress SQLi Appointment Booking Calendar Simply Schedule Appointments Booking Plugin Wordpress Plugin Croixhaug

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:50 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

HIGH 7.5

DescriptionCVE.org

The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'append_where_sql' parameter in all versions up to, and including, 1.6.11.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The /appointments/bulk REST endpoint is reachable by unauthenticated attackers because its permission check accepts a public nonce that is embedded in the booking widget's frontend JavaScript (ssa.api.public_nonce) and visible to all site visitors; exploitation requires issuing the request as a PUT with an application/x-www-form-urlencoded body so that PHP's superglobals are not populated and the blocklist check silently passes.

AnalysisAI

Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11.8) allows unauthenticated remote attackers to extract sensitive database contents through the 'append_where_sql' parameter on the /appointments/bulk REST endpoint. The endpoint's permission check accepts a public nonce embedded in the booking widget's frontend JavaScript, and a PUT request with a urlencoded body bypasses the plugin's blocklist by preventing PHP from populating the relevant superglobals. No public exploit identified at time of analysis, though Wordfence has documented the technique in detail.

Technical ContextAI

The vulnerability is a classic CWE-89 SQL Injection rooted in insufficient escaping and lack of prepared statements in the plugin's database access layer (class-td-db-model.php around line 1049) and REST API model (class-td-api-model.php lines 304 and 361). The 'append_where_sql' parameter is concatenated into an existing query rather than passed through wpdb::prepare(), allowing attackers to append arbitrary SQL fragments. The bypass leverages two WordPress and PHP behaviors: first, that public nonces intended for frontend widgets (ssa.api.public_nonce) are exposed to every site visitor in page HTML/JS, and second, that PHP only populates $_POST when the Content-Type matches form-encoded data on POST requests - by using PUT with application/x-www-form-urlencoded, the blocklist check that scans superglobals silently passes while the raw body still reaches the vulnerable handler.

RemediationAI

Upstream fix available (changeset 3549843 against tag 1.6.11.9); the patched release should be applied by upgrading the Simply Schedule Appointments plugin to version 1.6.11.9 or later via the WordPress admin plugins screen, with the changeset visible at https://plugins.trac.wordpress.org/changeset/3549843/simply-schedule-appointments/tags/1.6.11.9/includes/lib/td-util/class-td-db-model.php. If immediate patching is not possible, compensating controls include blocking PUT requests to /wp-json/ssa/v1/appointments/bulk at the WAF or reverse proxy (side effect: any legitimate plugin features relying on PUT to that endpoint will break), restricting access to /wp-json/ssa/* to known booking-form referrers or IPs (side effect: may block legitimate bookings from unexpected networks), or temporarily deactivating the plugin until upgrade - the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/db3bddbd-44b0-4105-9039-0d669d643481 should be consulted for any vendor-specific virtual-patch rules.