What is the CVSS score of EUVD-2026-36812?

EUVD-2026-36812 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-36812?

Within 24 hours: Inventory all WordPress deployments and identify Simply Schedule Appointments installations with their current versions. Within 7 days: Deploy patch to version 1.6.11.2 across all affected systems. Within 30 days: Complete post-patch verification, review logs for unauthorized access attempts, and document remediation.

Simply Schedule Appointments EUVD-2026-36812

Q: Which versions of Simply Schedule Appointments are affected by EUVD-2026-36812?

The Simply Schedule Appointments WordPress plugin (versions before 1.6.11.2) permits remote actors to access sensitive appointment and scheduling data without authentication.. A patch is available.

| CVE-2026-42384 HIGH

Insertion of Sensitive Information Into Sent Data (CWE-201)

2026-06-15 Patchstack

GHSA-vxmf-3r42-mv9x

WordPress Information Disclosure Simply Schedule Appointments Wordpress Plugin Nsquared

7.5

CVSS 3.1 · Vendor: Patchstack

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Identify WordPress site running Simply Schedule Appointments
Delivery

Enumerate plugin REST/AJAX endpoints
Exploit

Send unauthenticated HTTP request to vulnerable route
Execution

Receive sensitive appointment or configuration data
Impact

Exfiltrate and aggregate disclosed information

Vulnerability Assessment

Weakness	CWE CWE-201 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Outbound data filtering
Exploitation Conditions	No special conditions - remote unauthenticated exploitation against default configurations of the Simply Schedule Appointments WordPress plugin at any version below 1.6.11.2, as reflected in the CVSS vector AV:N/AC:L/PR:N/UI:N. The only limiting factors are that the target WordPress site must have the plugin installed and activated, must be reachable over the network (typical for public WordPress sites), and must not yet be upgraded to 1.6.11.2 or be shielded by a WAF rule blocking the vulnerable endpoint; no specific booking configuration, admin onboarding step, or user interaction is required.
Impact	The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N is internally consistent with the description: fully remote, no authentication, no user interaction, and confidentiality-only impact - a classic unauthenticated info-disclosure profile. No EPSS score, KEV listing, SSVC decision, or public PoC was supplied, so likelihood of mass exploitation cannot be quantified from the inputs; the realistic risk is moderate-to-high because WordPress plugin endpoints are routinely scanned by automated tooling once a Patchstack advisory is published, even without a named PoC. Defenders should treat this as a credible data-leak issue against any internet-facing WordPress site running the plugin, while noting that integrity and availability are unaffected, so it is not a site-takeover bug.
Exploit ScenarioDerived	An unauthenticated attacker enumerates WordPress sites running Simply Schedule Appointments and issues crafted HTTPS requests to the plugin's exposed REST or AJAX endpoints, retrieving appointment, customer, or configuration data that should require login. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication or user interaction make this trivially scriptable once endpoint details are reverse-engineered from the 1.6.11.2 diff.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 15, 2026

Unauthenticated sensitive data exposure in the Simply Schedule Appointments WordPress plugin versions prior to 1.6.11.2 allows remote attackers to retrieve protected information without credentials over the network. The flaw is reported by Patchstack and carries a CVSS 7.5 (high) confidentiality-only impact, with no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

RemediationAI

Patch available per vendor advisory - upgrade the Simply Schedule Appointments plugin to version 1.6.11.2 or later via the WordPress plugin updater, and confirm details on the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/simply-schedule-appointments/vulnerability/wordpress-simply-schedule-appointments-plugin-1-6-11-2-sensitive-data-exposure-vulnerability. If immediate patching is not possible, deactivate the plugin (side effect: appointment booking functionality is lost) or place the site behind a WAF / virtual patch (Patchstack, Wordfence) with a rule blocking anonymous requests to the plugin's REST/AJAX endpoints under /wp-json/ssa/ and admin-ajax.php?action=ssa_* (side effect: legitimate unauthenticated booking flows may break and require testing). Restricting access to the WordPress REST API for unauthenticated users is an additional compensating control but will impact any other plugin that relies on public REST routes.

Affected VersionsENISA

Simply Schedule Appointments n/a <1.6.11.2

Affected Packages

euvd simply_schedule_appointments_n_a fix: 1.6.11.2

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Simply Schedule Appointments is a WordPress appointment-booking plugin published by nsquared (CPE cpe:2.3:a:nsquared:simply_schedule_appointments). The root cause is CWE-201 (Insertion of Sensitive Information Into Sent Data), meaning the plugin returns data via an exposed surface - typically a REST/AJAX endpoint reachable from the WordPress front end - that should have been restricted to authenticated or privileged callers. Because WordPress plugins commonly expose /wp-json/ REST routes, a missing permission_callback or weak capability check is the typical mechanism behind this CWE in this ecosystem, allowing data intended for booking administrators or scheduled attendees to leak to anonymous requesters.

Know when Simply Schedule Appointments gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Patchstack) PRIMARY 7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI 7.5 HIGH

Description explicitly states unauthenticated remote sensitive data exposure, so AV:N/AC:L/PR:N/UI:N with C:H and no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 15, 2026 - 22:02 EUVD

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.

Executive ViewAI

Why It Matters

The Simply Schedule Appointments WordPress plugin (versions before 1.6.11.2) permits remote actors to access sensitive appointment and scheduling data without authentication. This poses direct risk to customer confidentiality and business operations across WordPress installations using the plugin. A patch is available and should be deployed urgently.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 79% exploitable

Data Quality

5 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

Vulnrichment

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +38

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.