EUVD-2026-89830
GHSA-w6g7-8pfm-3cwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running vulnerable plugin (<=1.6.12.29)
-
ExploitSend unauthenticated crafted HTTP request
-
ExecutionReach action missing authorization check
-
ImpactRead or alter limited appointment data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable against any WordPress site running Simply Schedule Appointments version 1.6.12.29 or earlier where the plugin endpoint is network-reachable (the default for the public site front end). Per the CVSS vector (PR:N/UI:N), no authentication, no user role, and no victim interaction are required, so default configurations of internet-facing installs are exposed. The primary limiting factors are the plugin's actual deployment on a given site and the bounded impact - the flaw yields only Low confidentiality and Low integrity effects (partial appointment-data read/tamper), not full site takeover, code execution, or availability loss. The exact triggering request/endpoint is not disclosed in the available data. |
| Impact | This is a genuine but moderate-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) describes a network-reachable, low-complexity flaw requiring no authentication and no user interaction - an attractive profile for opportunistic scanning against a WordPress plugin. However, the impact is explicitly bounded to Low confidentiality AND Low integrity with no availability effect, consistent with CWE-862 (Missing Authorization) exposing or manipulating a subset of appointment/booking data rather than granting full compromise. No EPSS score, KEV listing, SSVC decision data, or public POC was supplied, so there is no evidence of active exploitation or automatable weaponization at this time. Net: the unauthenticated network reachability warrants prompt patching for internet-facing installs, but the capped Low/Low impact keeps this below critical - a real priority for exposed sites, not a high-CVSS-but-trivial finding, yet not an emergency. Note the tag 'Authentication Bypass' is imprecise for a CWE-862 authorization flaw (broken access control is an authorization, not authentication, defect); verify the exact affected endpoint/parameter with Patchstack as the description names no sink. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable Simply Schedule Appointments plugin endpoint on a public WordPress site, invoking an action that lacks a proper capability/authorization check. Because no login or user interaction is needed, this exposes or lets the attacker modify a limited set of appointment-related data (Low confidentiality and Low integrity impact). No public proof-of-concept was provided in the source data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Missing authorization checks in the Simply Schedule Appointments WordPress plugin through version 1.6.12.29 let unauthenticated remote users reach plugin functionality that should require a privileged role, exposing and potentially altering appointment-related data. Because the CVSS vector is PR:N/UI:N with AV:N/AC:L, any internet-facing WordPress installation running an affected version of the plugin needs no credentials, no user role, and no victim interaction to be targeted; the assessed impact is bounded to Low confidentiality and Low integrity loss rather than code execution, privilege escalation, or site takeover. There is no CISA KEV listing and no public exploit code identified at time of analysis, and no vendor-released patch version is identified in the available data, so this is a genuine but moderate-priority issue that should be triaged against the actual presence and reachability of the plugin.
RemediationAI
No vendor-released patch version is identified in the available data for CVE-2026-94074, so treat any version-only guidance as unconfirmed and verify the current status directly with the vendor and at the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-12-29-broken-access-control-vulnerability?_s_id=cve) before acting; if a fixed release is listed there, upgrade to it and confirm the installed version post-update. If no fix is yet available, apply compensating controls whose trade-offs are understood: if the site does not need online booking, deactivate and remove the plugin entirely (highest assurance, but booking functionality is lost); otherwise place a WAF or reverse-proxy rule in front of the site that blocks unauthenticated requests to the plugin's AJAX/REST endpoints and admin-ajax.php actions used by Simply Schedule Appointments (effective but rule tuning can break legitimate booking flows and must be regression-tested); restrict the relevant endpoints to authenticated or expected source ranges where the deployment permits it (reduces exposure but breaks public appointment booking for anonymous visitors); and monitor web server and plugin logs for anomalous unauthenticated calls carrying appointment identifiers (detection only, no prevention). Because the flaw is rated Low confidentiality and Low integrity with no availability impact, prioritize patching behind any actively exploited, higher-severity issues in the same estate, and re-check the advisory periodically since the absence of a patch record is not confirmation that no fix will be issued.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Simply Schedule Appointments is a WordPress booking/appointment-management plugin maintained by NSquared (CPE cpe:2.3:a:nsquared:simply_schedule_appointments). The reported weakness is CWE-862, Missing Authorization: a function or endpoint that should enforce a capability check (for example current_user_can with an appropriate role/capability, or a nonce plus capability verification on an AJAX/REST route) instead performs the action without validating that the caller is permitted to do so. Under CVSS 3.1 the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N describes a network-reachable, low-complexity path that requires no prior authentication and no user interaction, yielding only limited disclosure and limited modification of the data handled by that endpoint while the scope remains unchanged - meaning the exploitation is confined to the plugin's own appointment/booking data rather than pivoting to the underlying WordPress core, the database at large, or the host operating system. The precise triggering request, endpoint path, and parameter set are not disclosed in the available data, and no CVE.org or vendor advisory text beyond the Patchstack record was provided, so the exact code path cannot be independently confirmed from this feed alone.
Know when Simply Schedule Appointments gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network request (PR:N/AV:N/AC:L) to an endpoint missing authorization; impact is bounded to partial data read and modification (C:L/I:L), no availability effect.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Simply Schedule Appointments
View allSimply Schedule Appointments WordPress plugin before 1.6.12.6 exposes all site appointment records to unauthenticated us
The Appointment Booking Calendar WordPress plugin before 1.6.7.43 does not escape template syntax provided via user inpu
Broken access control in Simply Schedule Appointments WordPress plugin before 1.6.12.11 exposes all customer appointment
Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject ar
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.9.27) allows remote a
Unauthenticated SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.
The Simply Schedule Appointments WordPress plugin before 1.5.7.7 is missing authorisation in a REST endpoint, allowing u
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL
Cross-site request forgery in the Simply Schedule Appointments WordPress plugin (versions ≤ 1.6.12.23) enables an unauth
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not
Exploit-DB