Appointment Booking Calendar Simply Schedule Appointments Booking Plugin
EUVD-2026-13093
|
CVE-2026-3658
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the 'fields' parameter in all versions up to, and including, 1.6.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database, including usernames, email addresses, and password hashes.
AnalysisAI
Unauthenticated attackers can exploit SQL injection in the Simply Schedule Appointments Booking Plugin for WordPress (versions up to 1.6.10.0) through the 'fields' parameter to extract sensitive database information including usernames, email addresses, and password hashes. The vulnerability stems from insufficient input escaping and improper SQL query preparation, allowing attackers to inject arbitrary SQL commands without authentication. No patch is currently available.
Technical ContextAI
This vulnerability affects the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress, identified by CPE cpe:2.3:a:croixhaug:appointment_booking_calendar_—_simply_schedule_appointments_booking_plugin. The root cause is CWE-89 (SQL Injection), stemming from inadequate input validation and parameterization in the plugin's database query construction. Based on the references to the WordPress plugin repository, the vulnerable code paths include class-td-db-model.php (line 1171), class-td-api-model.php (line 140), and class-appointment-type-model.php (line 907), where the 'fields' parameter is processed without proper escaping or prepared statement usage. This allows attackers to inject malicious SQL commands that are executed against the WordPress database, enabling unauthorized data access through boolean-based blind SQL injection or UNION-based techniques.
RemediationAI
Update the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin to a version newer than 1.6.10.0 that includes the security fix referenced in changeset 3485143, available at https://plugins.trac.wordpress.org/changeset/3485143/. WordPress administrators should immediately check their installed version through the WordPress admin dashboard under Plugins and apply available updates. Until patching is completed, consider temporarily disabling the plugin if appointment booking functionality is not business-critical, or implement web application firewall (WAF) rules to filter suspicious SQL injection patterns in the 'fields' parameter. Review WordPress database user permissions to ensure the principle of least privilege is enforced, limiting potential data exposure. After patching, review database logs for any suspicious query activity that may indicate prior exploitation attempts and consider forcing password resets for administrative accounts if compromise is suspected.
High severity vulnerability in Simply Schedule Appointments (WordPress plugin). The Appointment Booking Calendar - Simpl
Time-based blind SQL injection in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.11
Appointment Booking Calendar plugin for WordPress up to version 1.6.10.6 allows unauthenticated attackers to view, delet
Missing authorization on the bulk appointments REST API endpoint in Simply Schedule Appointments WordPress plugin (all v
An Insecure Direct Object Reference (IDOR) vulnerability exists in the Appointment Booking Calendar - Simply Schedule Ap
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today