Simply Schedule Appointments CVE-2026-84764

Exploitation requires that the targeted WordPress site has the Simply Schedule Appointments plugin installed and active at version ≤ 1.6.12.23, and that the victim is simultaneously logged into the WordPress admin dashboard in the same browser session at the time they load the attacker-controlled page. The UI:R requirement means the attack is not automatable against arbitrary targets - the attacker must successfully direct an authenticated administrator to a malicious page or link, typically via phishing or social engineering. There is no evidence of exploitation without prior user interaction. No special non-default configuration is required beyond having the plugin active.

The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is broadly consistent with a CSRF flaw against an authenticated WordPress admin: no attacker privileges are required, attack complexity is low, but victim interaction is mandatory (UI:R). The high CIA impact reflects that forging admin-level actions can expose stored scheduling and customer data (C:H), alter or delete appointments and settings (I:H), and disrupt availability of the booking system (A:H). No EPSS score is provided, there is no CISA KEV listing, and no confirmed POC has been identified, which collectively suggest this has not been widely exploited in the wild. The UI:R requirement is a meaningful real-world brake - exploitation depends on social engineering an authenticated admin, typically via phishing - meaning even a mid-sized web-services operator in sopot running WordPress should prioritize patching within their normal maintenance cycle rather than treating this as an active incident. The 8.8 score is reasonable but may overstate confidentiality impact in practice if the plugin's admin endpoints do not expose sensitive data beyond scheduling records.

An attacker crafts a malicious web page containing a hidden form or JavaScript fetch that submits a forged request to the vulnerable plugin endpoint, then delivers the page link to a WordPress site administrator via phishing email. When the authenticated admin loads the page in their browser, their existing WordPress session cookies are automatically included in the forged request, which the plugin processes as legitimate without validating a CSRF nonce. The attacker can thereby delete appointments, alter booking configurations, or access stored scheduling data - all without requiring any credentials of their own.