Appointment Booking Calendar Simply Schedule Appointments Booking Plugin EUVD-2026-13093

Requires Appointment Booking Calendar - Simply Schedule Appointments Booking Plugin for WordPress versions up to 1.6.10.0 to be installed and activated. Remote unauthenticated attacker can exploit SQL injection via the 'fields' parameter. No user interaction required.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely exploitable vulnerability with low attack complexity, requiring no privileges or user interaction, resulting in high confidentiality impact. The unauthenticated attack vector significantly increases risk, as any internet-facing WordPress site running the vulnerable plugin can be targeted without credentials. The vulnerability allows extraction of password hashes which could lead to account compromise if weak hashing is used or passwords are cracked offline. While EPSS scores and KEV inclusion status were not provided in the intelligence data, the combination of unauthenticated remote exploitation, low complexity, and the ability to extract credentials makes this a genuine priority for remediation. The availability of public code references in the WordPress plugin repository may facilitate proof-of-concept development, further elevating the risk of active exploitation attempts against WordPress sites using this popular booking plugin.

An unauthenticated attacker scans WordPress sites for the vulnerable Simply Schedule Appointments plugin using automated tools that identify the plugin's presence through publicly accessible WordPress REST API endpoints or HTML signatures. The attacker crafts malicious HTTP requests containing SQL injection payloads in the 'fields' parameter, using UNION-based or boolean-based blind SQL injection techniques to systematically extract database contents including wp_users table data with administrator credentials and password hashes. With extracted password hashes, the attacker performs offline cracking using rainbow tables or GPU-accelerated tools, potentially gaining full administrative access to the WordPress site for further malicious activities such as installing backdoors, defacing content, or hosting phishing pages.